> -----Original Message-----
> From: Fox Flanders [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, July 08, 2003 10:12 AM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Regexp Rule Question
>
>
> I have a rule to find any 'a href' followed by an 'img src'
> later in the
> message, but I am getting nothing, which baffles me (and I am
> not a regex
> newbie).
>
> rawbody HTML_CLICKABLE_IMAGE /a href.*?img src/i
> score HTML_CLICKABLE_IMAGE 1.00
>
> I am using SA 2.55 and have run the --lint check, and
> verified my last rule
> is working. Anyone know what I am doing wrong? Thanks!
>
> Below is the message:
> --------------------------------------------
>
> <HTML>
> <BODY bgcolor="#ffffff"> <p align="center"><font
> face="verdana"><KNZR>
> Make your nuts and <KRE>p<XARE>e<XPF>n<W>ís
> l<KFG>a<X>r<XJY>g<QCS>er and get
> more satisfaction.<br>
> <a href="http://www.fynance3.biz/mka/m2c.php?man=st4vp";>Read about it
> <WOW>he<YW>re<br><img src="http://www.fynance3.biz/p.gif";
> border=0></a><br><br>
> <a href=http://www.98207.biz/bek/>Remove me</a></font></p></body>
>
> </HTML>
>
>
I believe rawbody doesn't handle End of Lines. So the rule fails if the img
is on the next line. Also there is a HUGE possibility for FPs here and the
rule is going to lag down a bit. If you don't care how many things may be
between the href and img then split them into two meta rules and score them
combined.
The rule lags because of the .*? which I believe causes a lot of crunching.
A better way is to look for a certain amount of chars between the two. Like
.?{0,40} which looks for 0-40 things between the two. This should also
reduce FPs.
YMMV, HTH
Chris Santerre
System Admin
"A little nonsense now and then, is relished by the wisest men." - Willy
Wonka
-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
![http://www.fynance3.biz/p.gif"](http://www.fynance3.biz/p.gif"){kind=link}