John W Mickevich wrote:
Hello all!
...
I would like to know now to use a variable within SpamAssassin. For
example, how would I “capture” the last name of the From header field
for use in comparisons elsewhere? Here is a sample:
>From: "Molly Owens" <[EMAIL PROTECTED]>
>Subject: Me again Owens
I am sure a lot of folks have been seeing this spam coming thru lately.
I would like to check if the last name in From (Owens) shows up in the
Subject header. There may or may not be a better way to catch this
specific example, but being able to define a variable and use it
elsewhere would be great. I have to assume that SpamAssassin allows for
this, but I just can’t seem to figure out how to do it. I have seen
mention of eval and $1, $2, etc, and assume they have something to do
with defining or using a variable, but I can find no specifics on how to
use them.
SpamAssassin only supports captured variables within a single rule.
This means that you have to write a single rule that matches over all
headers. This is not very efficient or easy to write and usually it is
better to look for spam signs to trigger on. If you were running a
recent version of SA kept up to date with sa-update and SARE rules you
would see this messages hitting on a lot more rules.
Tom Brown posted this header rule to the sare-users list yesterday that
tries to do what you are talking about:
ALL =~ m/(?:^|\n)From: \S+ (\S+?)(?: |").*\nSubject:.*\1\n/s
Also, I am curious if using variables has a significant impact on
performance.
Yes, using variables does impact performance. In particular, the type
of rules you often need to make use of variables, matching over long
areas of text, are inefficient as well.
It would be interesting if SA added the ability to capture variable in
one rule and match against them in another. It would certainly have a
negative impact on performance at least for the rules that used it. And
someone would have to write the code to implement it. Could allow for
some pretty nifty rules though.
