Re: Beginning of line in body vs rawbody

[Reindl Harald]

Am 29.01.2016 um 17:16 schrieb Olivier Coutu:

I am trying to diagnose why certain rules do not fire as expected on
beginning of lines. Here is a MWE e-mail

# tests for SA list
body        T_BODY_TO_NOMULTI       /(^|\n|\r)To: \S/i #Should hit "To :
" at start of line
tflags      T_BODY_TO_NOMULTI       multiple maxhits=3
body        T_BODY_TO_MULTI         /(^|\n|\r)To: \S/im #I am unsure how
multiline interacts here

# Body Begins Low
body      CUST_BODY_7     /^(prase1|phrase2|prahse3).*/i
score     CUST_BODY_7     1.5
describe  CUST_BODY_7     Begins Low

you can skip all that "multiline interacts here" and other stuff by just set "normalize_charset 1" in your confuguration and write ordinary regex even when the spammer built a table construct to split a sentence after the normalization it's plaintext with single spaces

signature.asc
Description: OpenPGP digital signature