On Wed, Mar 17, 2010 at 07:11:33PM +0000 or thereabouts, Martin Gregorie wrote:
> On Wed, 2010-03-17 at 13:26 -0500, Gary wrote:
> > Ok, I'll figure out a URI body rule from some examples on the SA website.
> >
> You're looking at this sort of pattern:
>
> uri RULENAME /(url1|url2|url3)/i
>
> and don't forget to escape dots in the URL ( replace . with \. ), but be
> warned, this approach tends to turn into a game of wackamole, so keep a
> careful eye out for patterns that can turn into a regex, e.g, a month or
> two back there were a lot of autogenerated URLs being used that all
> mapped onto something like www\.[a-z]{3}[0-9]{5}\.(com|net)
>
> Martin
Thanks Martin for your input and good ideas... I am afraid you are correct
about the "wacamole" approach. I sure wish there was something like
Freemail is to headers to apply to the body of emails, but I suspect it
would take huge resources to scan.
I appreciate your help.
--
Gary
