Modified regex to detect Microsoft ATP URLs

[glennzw]

Fix to address #1975

Test code for the regex:

package main

import (
	"fmt"
	"regexp"
)

func main() {


	var goPhishRegex = regexp.MustCompile("((\\?|%3F)rid(=|%3D)(3D)?([A-Za-z0-9]{7}))")


	testCases := [...]string{"hello world no rids here", "blah ?rid=AbC1234 blah", "blah ?rid=3DAbC1234 blah", "blah %3Frid%3DAbC1234 blah", "blah %3Frid%3D3DAbC1234 blah"}

	for i, emailContent := range testCases {

	  fmt.Printf("Test %d: ", i)
	  for _, r := range goPhishRegex.FindAllStringSubmatch(emailContent, -1) {
	    newrid := r[len(r)-1]
	    fmt.Printf(newrid)
	  }
	  fmt.Println()
	}

}

Test 0: 
Test 1: AbC1234
Test 2: AbC1234
Test 3: AbC1234
Test 4: AbC1234

https://play.golang.org/p/QmsWHgPRmQR

[jordan-wright]

Seems reasonable to me, thanks @glennzw!

[brian1318]

Sir ;
The Fixed code insert to which files. Thanks