On Sat, 20 Jun 2009, Jeremy Morton wrote:
John Hardin wrote:
D'oh, /me checks pastebins from first message...
Also, body rules match cleaned-up text with runs of spaces collapsed,
so you don't need to use + or {1,...}
Try this:
/\(\s?w{2,4}\smeds\d{1,4}\s(?:net|com|org)\s?\)/
Actually, I don't know where you get that idea from; as far as I can tell,
the SA rules are matching the original message text, not text with runs of
spaces collapsed; so that regex doesn't work for the vast majority of those
medsXX spams for me. I had to modify it to this:
/\(\s*w{2,4}\s+meds\d{1,4}\s+(?:net|com|org)\s*\)/m
Which matches something like '(www meds30 org)'... whereas your
suggested one doesn't
Note I said "body rules". I did test the sample message against that rule
before posting it. Are you using that RE in a rawbody rule?
If you want to see for yourself, put a rule like this into your test
framework:
body ALL_BODY /.+/
tflags ALL_BODY multiple
...and run a test message with lots of whitespace through it. You'll see
exactly what body rules are trying to match against.
(first www has a space AND a tab after it).
*that* I did not specifically test against, 'ang on...
...yep, the RE I posted matches on "(www [tab] meds88 net)" when used in
a body rule.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Liberals love sex ed because it teaches kids to be safe around their
sex organs. Conservatives love gun education because it teaches kids
to be safe around guns. However, both believe that the other's
education goals lead to dangers too terrible to contemplate.
-----------------------------------------------------------------------
14 days until the 233rd anniversary of the Declaration of Independence
