Re: Possible ignore CRLF?

[John Hardin]

On Fri, 26 Aug 2016, Robert Boyl wrote:

Rule
describe BRF_TEST123    test
body     BRF_TEST123 \bSe você não deseja mais receber nossos e-mails, 
cancele\b/i

That's missing a leading slash. Is that a copy+paste error? Do you run 
lint checks before restarting SA? That shouldn't have passed lint.

It should look like:

body     BRF_TEST123  /\bSe você não deseja mais receber nossos e-mails, 
cancele\b/i

score    BRF_TEST123 0.1

See here the message that qmail cant catch due to a CRLF in middle of text
(right after word "se") but icewarp can catch even with the CR LF.

If I remove the CR LF my qmail catches it (SA).

That's odd, as SA should normalize that into a single body paragraph in 
both cases.

http://pastebin.com/gyeDcA3H

It looks like the encoding is corrupted at that point:

   130. caixa de entrada,<br/>adicione o e-mail 
<strong>buddha...@buddhaspa.com.br<=
   131. /strong> ao seu cat&aacute;logo de endere&ccedil;os.<br/><br/>A Buddha 
Spa =
   132. respeita a sua privacidade e &eacute; contra o spam na rede.<br />Se=20
   133. voc&ecirc; n&atilde;o deseja mais receber nossos e-mails, <a 
href=3D"http:/=
   134. 
/trk.virtualtarget.com.br/index.dma/DmaOptOut?22125,438,29198,66c2087320c2e=

The end of line 132 doesn't look correct.

Maybe that's causing it to think there are *two* line breaks after the 
"Se", thus putting that into a separate paragraph?

It's interesting that the two platforms behave differently. Are they 
running the same version of SA? How is SA glued onto them (how do they 
pass messages to SA)?

If you have a test environment set up where yon can run SA against a test 
message and see the text that rules hit, you might want to add this rule:

body  __ALL_BODY  /./

That would make it clear whether or not SA was breaking the paragraph at 
that point.



--
 John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
 jhar...@impsec.org    FALaholic #11174     pgpk -a jhar...@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
 Windows and its users got mentioned at home today, after my wife the
 psych major brought up Seligman's theory of "learned helplessness."
                                             -- Dan Birchall in a.s.r
-----------------------------------------------------------------------
 2 days until Exercise Your Rights day