Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #22412

Re: contact page spammed

Show all headers | View raw

Michael Haufe (TNO) wrote:

> On Wednesday, December 25, 2013 11:34:40 PM UTC-6, Andrew Poulos wrote:
>> There's a contact page that I help maintain. Users enter some text (a
>> message) into a text field, and then click the submit button. The text
>> is processed and sent to a server page which generates an email.
>> 
>> Any message that contains a URL (ie. contains "http://" or "https://")
>> is ignored.
>> 
>> I use this to find URLs
>> 
>> var val =
>> document.forms['frmEnquiry'].elements['comments'].value.toLowerCase();
>> 
>> if ((val.indexOf("http://") != -1 ) ||
>>      (val.indexOf("https://") != -1 )) {
>>      // ignore stuff here
>> }

It is not a good idea to consider all messages containing URIs to be spam.

>> Lately we've been receiving emails that contain URLs. The URLs in the
>> email are all of the form
>> 
>>    Some text <a href=" http://www... ">blah</a>...
>> (There's a space between the double quotes and the URL)

Syntactically wrong, easy to spot.

>> Looking at the source for the email does not reveal any encoding of the
>> URLs. How could they have managed to get around the search for "http://"?
> 
> Disable JavaScript or post directly without using the form?

You can make it harder for spammers by using authentication tokens and 
*pseudo*-CAPTCHAs – which do *not* do what they claim to – …

> You can't avoid using server side validation

… but, in general, that is correct.

-- 
PointedEars

Twitter: @PointedEars2
Please do not Cc: me. / Bitte keine Kopien per E-Mail.

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

contact page spammed Andrew Poulos <ap_prog@hotmail.com> - 2013-12-26 16:34 +1100
  Re: contact page spammed "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2013-12-25 22:23 -0800
    Re: contact page spammed Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-12-26 07:45 +0100
  Re: contact page spammed Denis McMahon <denismfmcmahon@gmail.com> - 2013-12-26 18:40 +0000

csiph-web