[DRAFT] Optimize phishing_blue_button_file_sharing#4804
Closed
thunderkatz wants to merge 4 commits into
Closed
Conversation
…l anchor subtree regex.icontains(.raw, ...) scanned each anchor's entire rendered subtree (all descendant markup), so cost scaled with how much content each button wrapped rather than link count. This caused a very slow live evaluation on a message with content-heavy anchors. Checking the anchor's own @Style attribute via an xpath predicate avoids scanning descendants entirely.
length(body.previous_threads) == 0 OR'd with (A AND (subject.is_reply OR subject.is_forward OR length(body.previous_threads) > 0)) always reduces to just length(body.previous_threads) == 0 OR A, since the third disjunct is the exact negation of the first OR arm: P OR (A AND NOT P) == P OR A. The subject.is_reply/is_forward checks never affected the result. Verified equivalent by exhaustive truth-table test across all 32 input combinations.
github-actions
Bot
added
the
review-needed
Contributor
Shared Samples Sync - Action RequiredThis PR was not automatically synced to shared-samples because the author is not a member of the To enable syncing, an organization member can comment Once triggered, the rules will be synced on the next scheduled run (every 10 minutes). |
Contributor
Author
|
Closing in favor of #4817 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Old version ran xpath to grab every anchor, then regexed all html found within that anchor (including display text and subtags) to get styling info. That's a lot more content than we need, so have the xpath do the filter itself on just the anchor's style tag (much simpler, no regex involved)
Associated samples
n/a
Associated hunts
Same results on 14d hunt with 889 matched groups
Screenshot (insights)
n/a