Optimize xpath usage in phishing_blue_button_file_sharing.yml#4832
Merged
IndiaAce merged 2 commits intoJul 8, 2026
Conversation
…e regex Confirmed against the actual incident message: it has 29,414 <a href> tags (only 174 unique after dedup -- the same handful of links repeated thousands of times), and only 1 of those 29,414 anchors has a style attribute anywhere in its subtree. filter()'s regex ran against all 29,414 regardless, since none are excluded by link count, href scheme, or domain. Adding [@Style or .//@Style] to the xpath query prunes anchors with zero chance of matching before any node construction or regex work happens, without touching the existing regex/domain-check logic at all. Benchmarked at ~24x faster than the original on the real message (388ms -> 16ms), outperforming even a full xpath-predicate rewrite of the regex logic, likely because it's a plain attribute-existence check rather than a translate()+contains() string comparison.
github-actions
Bot
added
the
review-needed
Contributor
Shared Samples Sync - Action RequiredThis PR was not automatically synced to shared-samples because the author is not a member of the To enable syncing, an organization member can comment Once triggered, the rules will be synced on the next scheduled run (every 10 minutes). |
zoomequipd
approved these changes
Jul 8, 2026
IndiaAce
approved these changes
Jul 8, 2026
IndiaAce
deleted the
jkatzman/phishing-blue-button-has-style-xpath-prefilter
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
If an anchor or its subnodes doesn't have styling, there's no point in running a style-matching regex over its contents. xpath can do this filtering much faster than regex based on the actual attributes of the nodes, with the added bonus that it doesn't have to materialize a navigator for non-matching nodes.
Unlike previous attempts (#4804 and #4817), this one should also be logic neutral, since the regex can (and should) only really match the contents of a style attribute anyway.
Associated samples
n/a
Associated hunts
90d hunt: https://platform.sublime.security/hunts/019f4282-89e2-797b-8292-87f0572b0331
2 results, both the same campaign, actor put style element text in the anchor but didn't actually put them in a
style=attribute, so the new xpath filter doesn't grab them. However, given that browsers also don't render those style elements without the actual attribute, I think that makes the rule match the actual output better. Even without this low severity rule, 4 other medium severity rules still match.Screenshot (insights)
n/a