John Hardin wrote:
On Wed, 25 Mar 2009, Giampaolo Tomassoni wrote:
So why this actually works to me?
rawbody LARGETABLE
m'<tr\W(?:[^<]|<(?!t[dr]\W))*(?:<td\W(?:[^<]|<(?!t[rd]\W))*){30,}</tr'is
Got SA 3.2.4.
I had forgotten about tflags multiple - when did multiline rawbody get
added?
I thought "rawbody" was, literally, the raw message body considered as a
single string. There's an intermediate form you may be thinking of
instead (base64-decoded, quoted-printable decoded, may be broken down
line-by-line).
I've been using rawbody rules to match over multiple lines in the body
for a while now (3.2.x)
I'm holding off on creating a rule for the empty-table "content" in
these messages myself to see how much of a problem they are locally.
-kgd
