On Fri, 8 Apr 2016, Reindl Harald wrote:
Am 08.04.2016 um 17:05 schrieb John Hardin:
On Fri, 8 Apr 2016, Reindl Harald wrote:
> /.*need to buy products.*\?.*/i
>
> .* = any chars independent how often
Do NOT use ".*" in body or rawbody rules. That can lead to unbounded
processing times. Use a sane upper limit, e.g. ".{,20}", and try to
avoid repeated "." where possible
thanks for the hint but that's not possible in case of "contains" rules where
you don't know at which place the offeding phrase comes
Then the limit can be generous. And in the case of the above, you can
avoid backtracking issues by doing this instead:
products[^?]{,100}\?
...so that the character set you're skipping over doesn't contain the
value you're looking for. Note that this does not work in all cases, but
in this case it does avoid problems.
interesting that we have around 1100 such rules and the Spamassassin/ClamAV
virtual machine runs most of the day between 50 and 300 MHz
I said "can", not "will". It depends on the RE and the data you give it.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The Tea Party wants to remove the Crony from Crony Capitalism.
OWS wants to remove Capitalism from Crony Capitalism.
-- Astaghfirullah
-----------------------------------------------------------------------
5 days until Thomas Jefferson's 273rd Birthday
