creating rules

[Matt Kettler]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Glenn Steen wrote:
> On 29/09/05, Matt Kettler <mkettler at evi-inc.com> wrote:
> (snip)
> 
>>1) * isn't a character wildcard in regex, it's a repeat-count wildcard. ie: d*
>>will match any number of d's in a row (including 0).
> 
> (snip)
> 
>>in light of 1-3 I'd rewrite that as:
>>
>>header PROLO_GSPAM15 Subject =~ /Re\[\d\]:/i
> 
> Um, wouldn't
> header PROLO_GSPAM15 Subject =~ /Re\[\d\d*\]:/i
> or
> header PROLO_GSPAM15 Subject =~ /Re\[\d+\]:/i
> be better? I see a fair amount of these, and the're almost always "Re
> [12[" or somesuch... Then again, for some reason most of these are
> caught (BLs IIRC... @home now, can check tomorrow if anyone really
> cares).
> (snip)

Personally, I'd use a range.. I'd do \d{1,2} or \d{1,3}..

I never use + or * in spamassassin rules as a matter of general principle. While
it would be harmless to use + or * here, they are quite dangerous and can cause
extraordinarily large regex expansions which are painfully slow.

In particular,  putting .* in a SA body rule can burn quite a lot of CPU cycles
if the text leading up to it is common. For example /e.*xactly/i will do this
very nicely. For every "e" in the message, it's going to have to scan the rest
of the body looking for "xactly" anywhere in it, then go back and look for the
next e... ouch!






> 
>>to messages, for example Microsoft outlook with the auto-bcc plugin.
> 
> A lot of *curse-words* there:-)

True, but a lot of not-that-uncommon *curse-words* there. Remember, management
falls in the same class of curse words...

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!