Johnson, Robert F wrote:
>This header was missed by your rule example. Does anyone have any ideas
>why it was missed?
>
>Thanks in advance:
>
>
>Header
>--=_alternative 00390FDE48256FE2_=
>Content-Type: text/html; charset="gb2312"
>Content-Transfer-Encoding: base64
>
>
>Rule:
>rawbody CHINESE_WL_1_B /\bgb2312\b/i
>describe CHINESE_WL_1_B Whiltelist Simplified Chinese mimepart
>
>full CHINESE_WL_1_C /^Content-Type:\s+gb2312\b/im
>describe CHINESE_WL_1_C Whiltelist Simplified Chinese mimepart
>
>
>
It was not detected by the rawbody rule because this text would have
been stripped first and would have no chance of being matched by it at all.
It wasn't detected by the full rule because it doesn't have any ability
to deal with the quotes and other stuff. It's looking for the gb2312 to
be directly after the Content-Type:, without anything in between but spaces.
might I suggest this instead:
full CHINESE_WL_1_D /^Content-Type:.{0,30}\bgb2312\b/im
describe CHINESE_WL_1_D Whitelist Simplified Chinese mimepart
