Why do you need to match them at the same time? Using meta would be more
effective. Also this doesn't care what order From and To appear in headers.
header __FOO1 From =~ /pedro/i
header __FOO2 To =~ /pedro/i
meta FOO __FOO1 && __FOO2
But just to put it out there, if you want to capture and m
On Dec 6, 2018, at 12:14 PM, John Hardin wrote:
>
> Runaway backtracking that was killing masscheck for several people.
Hrm, that is disconcerting. I'm not sure where any backtracking might be
occurring...
Can anyone help improve this suggested rule?
rawbody AC_HTML_ENTITY_BONANZA_NEW
On Thu, 06 Dec 2018 14:32:37 -0500
Bill Cole wrote:
> You cannot get multiple hits from an ALL rule because the regex is
> matched against the whole block of headers. Once it matches, the test
> is done.
Just for the record, that isn't a limitation of "multiple"
header T_TEST1 Subject =~ /\
On 7 Dec 2018, at 8:33, RW wrote:
On Thu, 06 Dec 2018 14:32:37 -0500
Bill Cole wrote:
You cannot get multiple hits from an ALL rule because the regex is
matched against the whole block of headers. Once it matches, the test
is done.
Just for the record, that isn't a limitation of "multiple"
On Fri, 07 Dec 2018 09:14:11 -0500
Bill Cole wrote:
> On 7 Dec 2018, at 8:33, RW wrote:
>
> > On Thu, 06 Dec 2018 14:32:37 -0500
> > Bill Cole wrote:
> >
> >> You cannot get multiple hits from an ALL rule because the regex is
> >> matched against the whole block of headers. Once it matches, the
On Fri, 7 Dec 2018, Amir Caspi wrote:
On Dec 6, 2018, at 12:14 PM, John Hardin wrote:
Runaway backtracking that was killing masscheck for several people.
Hrm, that is disconcerting. I'm not sure where any backtracking might be
occurring...
This sort of thing is risky, especially in a ra
On 6 Dec 2018, at 15:25, Pedro David Marco wrote:
Thanks Bill and John...
Your words make sense to me. It seems that ALL means that SA puts all
headers into a Perl string (including \n chars) and tries the regex...
As John Hardin correctly states, a dot does not match the \n but
this is ch
