Body SA rule

[Mariano Absatz]

El 18 Mar 2003 a las 10:50, Stephe Campbell escribió:

> Mr. Winkler,
>  
> Thank you very much. That seemed to work, although I think I may have
> tried that same rule you provided. The difference was I used a rule name
> with a hyphen instead of underscore. Do you know if that is a real
> issue? I might be wrong though on whether I used your regexp prior, I
> tried so many.
Hi Steve,

I don't know much of the inner workings of SA, but I'd bet it uses the rule 
numbers as Perl identifiers (or part of Perl identifiers) at one time or 
another (e.g. as an index to a hash). Then a "-" would be an invalid 
character in a Perl identifier and that would prevent it from working, 
whereas "_" is a valid character.

Just my 2c.

>  
> Thanks again
>  
> Steve Campbell
> campbell at cnpapers.com <mailto:campbell at cnpapers.com> 
> 
> ----- Original Message ----- 
> From: Derek Winkler <mailto:dwinkler at ALGORITHMICS.COM>  
> To: MAILSCANNER at JISCMAIL.AC.UK <mailto:MAILSCANNER at JISCMAIL.AC.UK>  
> Sent: Tuesday, March 18, 2003 10:30 AM
> Subject: Re: Body SA rule
> 
> Here's one I use...
>  
> rawbody LOCAL_CNTNTFRM_vresp    /https?:\/\/.*?\.vresp\.com/i
> describe LOCAL_CNTNTFRM_vresp   Has " http://*.vresp.com
> <http://*.vresp.com> " in body
> score LOCAL_CNTNTFRM_vresp      3
> 
> In the reg exp /s and .s must be preceded by \, makes it confusing. The
> ? makes the s optional so http or https will work. The i after the final
> / means case insensitive.
>  
> Your reg exp would be "/http:\/\/www\.xx-yyyyy\.com/" off the top of my
> head anyways.
> 
> -----Original Message-----
> From: Stephe Campbell [mailto:campbell at cnpapers.com]
> Sent: Tuesday, March 18, 2003 10:19 AM
> To: MAILSCANNER at jiscmail.ac.uk
> Subject: Body SA rule
> 
> 
> This is not a MS problem, but I have yet been able to find anything in
> the SA archives and hope that someone using MS has done this before. I'm
> not versed in Perl, so I sort of need assistance. The people of this
> maillist really seem to be on the ball.
>  
> We receive a lot of spam from a particular group. Each mailing is from
> various sources, but all have the following line in them(actually a
> reply link where I have replaced the real address with x's, y's, etc):
>  
>  
>  visit at  <http://www.xx-yyyyy.com/34606zzz.html>
> http://www.xx-yyyyy.com/34606zzz.html
>  
> I would like to use a body or rawbody (uri or full maybe?) rule to find
> "html://www.xx-yyyyy.com" and give it a score in SA by adding it to my
> spam.assassin.prefs.conf file but have not yet figured out how to write
> it. My Header rules work fine, but all of my attempts at this seem to be
> all for nothing.
>  
> Any help would be appreciated and sorry for the non-MS stuff.
>  
> 
> 
> steve campbell
> campbell at cnpapers.com <mailto:campbell at cnpapers.com> 
> 
> 


--
Mariano Absatz
El Baby
----------------------------------------------------------
Make it idiot proof and someone will make a better idiot.