I'm getting lots of spams that are about 100+K long. The spam body contains two blocks of random news text copied from fox news or msnbc or the like, enclosed in a zero-point font block. I'm trying to match this simple pattern to give some extra points, but I can't seem to get it to work. I'm wondering if there is some buffer limit in SA that is preventing the match from working.

If I try

   rawbody LONG_HIDDEN m'<font style="font-size:0px">[^<]*<'s

I don't get a match, even though I know there is a </font> about 50K into the message.

But if I try

   rawbody LONG_HIDDEN m'<font style="font-size:0px">[^<]*'s

I do get a match. Note all I've done is remove the final "<" from the match text.

If I try

   rawbody LONG_HIDDEN m'<font style="font-size:0px">[^<]{990,}'s

I get a match.

but if I try

   rawbody LONG_HIDDEN m'<font style="font-size:0px">[^<]{997,}'s

I don't get a match, but I know there is over 100K of text after that font tag.

Can anyone see something I'm doing wrong, or know of some limitation in SA that will prevent these long matches from working?

Thanks,

       Loren

Reply via email to