David B Funk wrote: > On Wed, 17 May 2006, Stuart Johnston wrote: > >>> "Every variation" includes the whole world: FREE. To exclude the whole >>> word, I created a meta exception but as you might guess, this also finds >>> the whole word elsewhere in the same message. While its odd to have one >>> word mangled and another not, spammers do it. I'm told a negative >>> lookaround will solve this problem, but I can't figure out how to do >>> it. Everything I've read relates to neighboring text, not the same text. >>> >>> How do I write a single regex that includes every variation except a >>> single specific one? >> Do you mean negative lookahead? >> >> body __OBSFU_FRE1 /(?!FREE)\bF(\s|\s\s|\s\S... > > Almost, you -really- want that '\b' pattern enclosing the negative > lookahead qualifier, otherwise it won't give you the expected results.
Are you sure? I find this works just fine. FUZZY_MILF from the standard ruleset does this, as do 10 rules in 70_sare_obfu0.cf and 1 in 70_sare_specific.cf Try grep -P '\(\?\!\w+\)\\b' 70_sare_obfu0.cf Some of the shorter results are: body SARE_OBFU_BACK_NUM m'(?!BACK)\bb\d?a\d?c\d?k\b'i body SARE_OBFU_SAVE_NUM m'(?!save)\bs\d?a\d?v\d?e\b'i body SARE_OBFU_SAVINGS_NUM m'(?!savings)\bs\d?a\d?v\d?i\d?n\d?g\d?s\b'i body SARE_OBFU_NUM_YOUR m'(?!YOUR)\bY\d?O\d?U\d?R\b'i (why the author used m' instead of / is beyond me, as it serves no purpose in these rules.. but a lot of SARE rules have really weird style so I'll chalk it up to weird style.)
