On Mon, 2009-04-27 at 12:16 +0200, Andy Spiegl wrote: > > It's already been mentioned, but mimeheader is the right way to look > > at the headers of MIME parts. > > How about multiline Content-Types?
They appear to be wrapped. $ grep -A 1 image/ dslxxxx.png.msg Content-Type: image/png; name="DSL9020.png" $ spamassassin -D --cf="mimeheader TEST Content-Type =~ m~image/png; name=~" < dslxxxx.png.msg 2>&1 | grep 'eval rule TEST' [4719] dbg: rules: ran eval rule TEST ======> got hit (1) > I tried without success: > mimeheader NAMELESSGIF_ATTACHMENT Content-Type =~ > /image\/gif;\n[^a-z]+name=""/ > > But this seems to work: > mimeheader NAMELESSGIF_ATTACHMENT Content-Type =~ > /image\/gif;\s*(\n\s+)?name=""/ ^^^^^^^^^^^ The \s* matches a single space. The optional part does not match anything. :) -- char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}