I am using SA 2.55 on a redhat 7.2 machine.
I want to catch email with subjects that begin with: =?us-ascii?
I used: header gej_US_ASCII Subject =~ /\=\?us-ascii\?/i describe gej_US_ASCII blah blah score gej_US_ASCII 1.0
Checked with --lint, but there was no hit on the rule. Variations on the escaped characters did not work either. Can somebody spot the error?
The error is that the string you are looking for is part of the message encoding. It's explicitly specified in the docs that QP, HTML, base64, most other encoding is decoded prior to running the rules. This is done to prevent someone from using encodings to avoid matching rules.
You can try using a rawbody rule, but I don't think even rawbody rules will be sufficiently "uncooked" to catch that string. (rawbody gets base 64 and QP encodings decoded. I think the above is part of QP.
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
