/s didn't appear to work for rawbody in version 3.1.8 But I just tried
it on a different system running 3.2.5, and it works there. Sorry about
posting my question before testing my problem on a newer version! - Mark
Karsten Bräckelmann wrote:
On Sun, 2010-02-28 at 12:00 -0500, Mark London wrote:
Hi - I created a FULL rule that works fine with html in plain text.
However, if the html is base64 encoded, FULL rules don't appear to
work. A RAWBODY rule doesn't work either, because it doesn't ignore
line breaks. Any ideas?
full rules don't ignore line breaks either, do they?
Anyway, if you want to treat line breaks just like any other whitespace
and therefor possibly apply your rules to multi-line strings, have a
look at the /m and /s RE modifiers.
http://perldoc.perl.org/perlre.html#Modifiers
You don't need a special parsed or decoded message -- you can extend
your rule's RE.
Note that in this case proper bounding becomes even more crucial, since
the string to match against can be quite long. Don't use unbound
quantifiers like * and + unless absolutely necessary, but try to always
limit matching by using an upper bound quantifier, like {1,80}.
