curious about body rules

[James Gray]

    [ The following text is in the "utf-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Monday 03 October 2005 10:18, Jon Miller wrote:
> If I create a rule that checks the body content for certain words, can I
> just keep adding words to this one rule? It's to my understanding that SA
> will search the body of the e-mail for the words that are listed.
>
> example:
> body BodyTest_RULE /porn market penis calis/ i
> score BodyTest_RULE 4.0
> describe BodyTest_RULE This body test rule

Close, but no cigar ;)  The bit between the /.../ is a Perl regex and is 
matched, basically, as literal string.  To achieve what you are trying, the 
correct syntax is:

body BodyTest_RULE /(?:porn|market|penis|calis)/i

You may want to add the word-boundary delimiter "\b" before and after the 
parenthesis.  This will cause a match of each of the words but only if they 
occur BETWEEN word boundaries.

There's a great Perl regex primer at:
http://www.anaesthetist.com/mnm/perl/regex.htm

FWIW, the words you're trying to catch are usually heavily obfuscated so 
simple key-word matches are usually ineffective.  A number of people 
(including myself) have written custom rulesets for SpamAssassin that you can 
just load up and save yourself a heap of time and effort.  Google for the 
"SpamAssassin Rules Emporium" and here's the shameless self-promotion:
http://files.grayonline.id.au/

Hope that helps.

Cheers,

James
-- 
Keep your eyes wide open before marriage, half shut afterwards.
  -- Benjamin Franklin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!