[EMAIL PROTECTED] wrote:
On Mon, 7 Feb 2005 [EMAIL PROTECTED] wrote:
I just created a rule for the most common spams that have been making it
through SA, but for some reason, it's not showing up in the tests:
body SEE_ATTACH /See attachment message.html/i
describe SEE_ATTACH body contains See attachment message.html
score SEE_ATTACH 5.0
--lint shows no problems....
(replying to my own post)
I found out what the problem is, and it seems like it should be considered
a bug in SA. The text in question is in the second line of the body of
the message, and it seems it is being ignored by SA, because if I insert a
couple of LFs to move it down, the rule kicks in. I had tried changing it
from "body" to "header" (also tried "rawbody) and that didn't work. Here
is a look at the offending message, sans the html attachment:
have you tried escaping the period?
body SEE_ATTACH /See attachment message\.html/i
h2h
Alex
