On 10/16/19 4:11 PM, Bill Cole wrote: > On 16 Oct 2019, at 8:44, Giovanni Bechis wrote: > >> I have lot of emails like this one (redacted): >> https://pastebin.com/v5NCRK9d >> and I would like to write a rule that matches the "=0D" that appears on some >> lines, > > Are you sure? > > That's a QP-encoded carriage return. I would expect a lot of them in both > spam and ham. > it is a part of a meta-experiment
>> any hints ? > > You could try matching it as '\r' in a rawbody rule, but I'm not sure that > would work. If it does, you probably want '\r[^\n]' to exclude CRLFs, but you > should test that carefully > > What should work better is to use a 'full' rule and look for the undecoded > '=D0', probably with '=0D(?!=0A)' or even '=0D(?!(=0A|=?$)' > > e.g.: > > full QP_BARE_CR /=0D(?!(=0A|=?$))/m > > CAVEAT: not well tested... > Seems to work, more tests later. thanks Giovanni
