I'm getting lots of spams that are about 100+K long. The spam body contains
two blocks of random news text copied from fox news or msnbc or the like,
enclosed in a zero-point font block. I'm trying to match this simple pattern
to give some extra points, but I can't seem to get it to work. I'm wondering
if there is some buffer limit in SA that is preventing the match from
working.
If I try
rawbody LONG_HIDDEN m'<font style="font-size:0px">[^<]*<'s
I don't get a match, even though I know there is a </font> about 50K into
the message.
But if I try
rawbody LONG_HIDDEN m'<font style="font-size:0px">[^<]*'s
I do get a match. Note all I've done is remove the final "<" from the match
text.
If I try
rawbody LONG_HIDDEN m'<font style="font-size:0px">[^<]{990,}'s
I get a match.
but if I try
rawbody LONG_HIDDEN m'<font style="font-size:0px">[^<]{997,}'s
I don't get a match, but I know there is over 100K of text after that font
tag.
Can anyone see something I'm doing wrong, or know of some limitation in SA
that will prevent these long matches from working?
Thanks,
Loren