Franklin Currah wrote: > I have been looking for a plugin or rule or some method of > marking/scoring a message if it is a BCC. > > My little mind was thinking of a rule that compares headers To: and > Delivered To: and marks/scores if one isn't inside the other, but I'm > not sure of how to do variables in regex. > > Point me in the right direction please :) > The closest thing to "variables" in a regex. is a backreference using () and \1.. ie /([0-9])[a-z]\1/
Will match 1b1 but not 1b2. The backreference \1 forces a match of the same text that was matched by the first (). However some points: 1) You'll have to do this as a single regex applied across the entire header block, and using backreferences at all is kinda inefficient. The result will likely be very slow. You can't do two separate SA rules and "compare notes" between them. 2) You'll have to check both the To: and the Cc: header. Normally in SA you don't have to worry about this, but since you'll have to use the "ALL" pseudo-header to get the entire header block, you'll have to worry about it. 3) Because of the complexity of 1 and 2, this would be much better done with a perl plugin than a regular regex based rules. That can store the results of two separate regexes and compare them, without having to scan/store all the text between. All that said, are you *SURE* this is something that would be useful? Remember, normal posts to a mailing list, even this list, will arrive to you as a BCC, not a To. Do some checking around, you probably get a lot more mail that's BCC'ed to you than you think.. Be sure to consider these common matches: newsletters (spam or nonspam) mailing list posts spam viruses the occasional email from a friend who is emailing everyone they know and is using BCC so they're not telling members of different friend groups the address of everyone they know. (I did this when I sent an email announcing my daughter's birth. I sent it "To:" myself, and bcc'ed it to multiple groups of friends and family at once, many of whom don't know each other. ie: my college buddies from Iowa don't know my high school friends from Maryland. It also makes for a less cluttered email header.)
