HTML5 wbr tag causes phising detection

[mattias berge]

The html5 wbr tags seem to cause MailScanner to think of a link as
different from the title.


<p class="MsoNormal"><span style="">Min presentation:&nbsp;</span><a href="
http://host/kategori_blogg/buzz-kommunikation/something-something-i-something-something"
target="_blank">http://<wbr>host/kategori_<wbr>blogg/buzz-kommunikation/<wbr>somthing-something-i-<wbr>something-something</a><span
style="">/<u></u><u></u></span></p>


This gives the "MailScanner has detected a possible fraud". Is this a known
problem?



Mailscanner 4.84.5
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20131108/10d56b00/attachment.html

[Mark Sapiro]

Post by mattias berge
The html5 wbr tags seem to cause MailScanner to think of a link as
different from the title.
<p class="MsoNormal"><span style="">Min presentation:&nbsp;</span><a
href="http://host/kategori_blogg/buzz-kommunikation/something-something-i-something-something"
target="_blank">http://<wbr>host/kategori_<wbr>blogg/buzz-kommunikation/<wbr>somthing-something-i-<wbr>something-something</a><span
style="">/<u></u><u></u></span></p>
This gives the "MailScanner has detected a possible fraud". Is this a
known problem?
Mailscanner 4.84.5

I'm running MailScanner 4.84.6 which shouldn't be different from 4.84.5
in this respect, but I tested with a message containing exactly the
above HTML but with 'host' replaced by 'msapiro.net' in both cases, and
it did not trigger the possible fraud detection.

I then retested with 'msapiro.net' as the host in the href and
'ms2.msapiro.net' as the host in the text, and it did trigger the
possible fraud detection.

In both cases, there was a <wbr> tag in the text, i.e.
'http://<wbr>msapiro.net/...' in the first case and
'http://<wbr>ms2.msapiro.net/...' in the second.

Thus, I have to conclude this is not an issue in MS 4.84.6.

Aside: Why would Microsoft Office or whatever generated this HTML in the
first place want to allow breaking the text in the middle of a
representation of a URL?