I'm trying to write a rule to count how many chr's are in a HTML message.
My test rule looks like:
 
full    T_FOO    /<html>.{60,110}<\/html>/i
 
The problem is that none of the test options (rawbody, body, full) provide the ability to test the entire message like this.
 
I am guessing I need an eval function for this?
 
I am thinking I might have found a great way to catch those image only spams,
 
Something like this:
IF <A tag exists, AND IF <img tag exists AND IF message length is 60-110 bytes
 
Can anyone help me out?
 
Thanks,

Reply via email to