Adi,

> First, it read the sender, and put it into a variable
> Then, it check, if the recipient is the same as that variable
> if true, then give score 3.0

The trick is to let a regexp see an entire mail header section.
Unfortunately it means we can't reuse already parsed addresses
in From and To header fields, but need to reparse it all in a regexp.

The rules below comes close, but is not exact (the TOFROM rule
only checks the first To). Mind the line wraps, there are three
long lines, each starting by 'header':


header SAME_FROMTO1 ALL =~ m{^From: (?: . | \n[\ \t] )* <\s*(.+)\s*> (?s:.*) 
^To: (?: (?: "[^"]*" | \([^)]*\) | 
[\ \t]+ | \n[\ \t]+ )*? \1 [,(\ \t\n] | (?: . | \n[\ \t])* <\s*\1\s*>)}mix
header SAME_FROMTO2 ALL =~ m{^From: (?: "[^"]*" | \([^)]*\) | [\ \t]+ | \n[\ 
\t]+ )* ([^<>,;\s...@[0-9a-z._-]+\.
[a-z]{2,})\b (?s:.*) ^To: (?: (?: "[^"]*" | \([^)]*\) | [\ \t]+ | \n[\ \t]+ )*? 
\1 [,(\ \t\n] | (?: . | \n[\ 
\t])* <\s*\1\s*>)}mix
header SAME_TOFROM  ALL =~ m{^To: (?: . | \n[\ \t] )* (?:\b|<) 
([^<>,;\s...@[0-9a-z._-]+\.[a-z]{2,}) \b (?!\.) 
(?s:.*) ^From: (?: (?: "[^"]*" | \([^)]*\) | [\ \t]+ | \n[\ \t]+ )*? \1 [,(\ 
\t\n] | (?: . | \n[\ \t])* 
<\s*\1\s*>)}mix
meta   SAME_FROMTO  SAME_FROMTO1 || SAME_FROMTO2 || SAME_TOFROM
score  SAME_FROMTO1 0.1
score  SAME_FROMTO2 0.1
score  SAME_TOFROM  0.1
score  SAME_FROMTO  1.5


Mark

Reply via email to