> Then there's the other problem: rawbody rules seem to act on a
> line-by-line basis,
Yes. By design. :-( (Which I consider broken design.)
so you can look for /href=h$/ or /^ttp/ but not
> /href=h\nttp/
I'm pretty sure (but not positive) that the rawbody rule might have been
hitting in this case, because the line was broken with cr's rather than
actual newlines. On the other hand, I may well have added the rawbody rule
as a duplicate of the full rule without thinking about it. I tend to
duplicate most of my rawbody or full rules as both, since they will often
hit different cases.
Loren
A quick check of last month's spam indicates several hundred hits on these
rules. In every case it looks like both rules hit.
