Hi, > > ifplugin Mail::SpamAssassin::Plugin::BodyEval > > if can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length) > > > body __BODY_LENGTH_100 eval:check_body_length('100') > > This indeed may be a neat substitution to the __RB_LE_nnn and __CHUNK > rules discussed, to match short message bodies. > > However, there's a considerable difference: The rawbody includes all > textual MIME-parts only, while the check_body_length() eval uses the > pristine body, covering all MIME-parts. > > In retrospect, this actually (though slightly fuzzily) matches the > desired behavior of the rules originally discussed with Alex back in Oct > 2013. The goal was, to identify short message bodies with a URI, but to > exempt messages where the actual payload is an attachment. That eval > includes the attachments, rawbody doesn't. > > > meta BLAH_100 (__HAS_URI && __BODY_LENGTH_100) > > endif > > endif
This is the quoted-printable text/html content: <HTML><HEAD></HEAD> <BODY dir=3Dltr> <DIV dir=3Dltr> <DIV style=3D"FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000"> <DIV>Hi! <A = href=3D"http://example.ru/rnj/trouble.php">http://example.ru/rnj/trouble.php </A></DIV></DIV></DIV></BODY></HTML> where example.ru is the real domain (which is now a dead link anyway). The rendered version would be so much easier to parse, but can that be done separately, and will there always be a text component? Thanks, Alex