[Mimedefang] Regexp?

[Ashley M. Kirchner]

    Can MDefang understand a regexp like this:  (sorry for wrapping, if
any)
    ext =
'(a(d[ep]|r[cj]|s[dmxp]|u|vi)|b(a[st]|mp|z[0-9]?)|c(an|hm|il|lass|md|om|(pp|\+\+)?|sv)|d(at|e?b|ll|o[ct])|e(ml|ps?|xe)|g(if|z?)|h(lp|t(a|ml?)|(pp|\+\+)?)|in[ci]|j(ava|pe?g|se?|sp|tmpl)|kbf|l(ha|nk|og|yx)|m(d[abew]|p(e?g|[32])|s[ip])|ocx|p(a(tch|s)|c[sx]|df|h(p[0-9]?|tml?)|if|[lm?]|n[gm]|[po][st]|p?s)|r(a[mr]|eg|pm|tf)|s(c[rt]|h([bs]|tml?)|lp|ql|ys)?|t(ar|ex|gz|iff?|xt)|u(pd|x)|vb[es]?|w(av|m[szd]|p(d|[0-9]?)|s[cfh])|x(al|[pb]m|l[stw])|z(ip|oo))'

    What about matching like this:

    ^content-type:${ws}(multipart/(signed|encrypted))|(application/)

^content-disposition:${ws}attachment;${ws}.*name${ws}=${ws}${dq}.*\.${ext}(\..*)?${dq}${ws}$

    ^content-transfer-encoding:${ws}base64
    $ name${ws}=${ws}${dq}.*\.${ext}(\..*)?${dq}${ws}$
    $ begin${ws}[0-9]+${ws}.*\.${ext}(\..*)?${ws}$
    ^content-transfer-encoding:${ws}base64

    ...where ws = '[  ]*($[     ]+)*'  (those spaces are a TAB+space)
         and dq = '"'

    And last, how about scanning the BODY of the message:

    \<(!doctype|[sp]?h(tml|ead)|title|body)

\<(app|bgsound|div|embed|form|i?l(ayer|ink)|img|i?frame(set)?|meta|object|s(cript|tyle))

    =3d


    I'm trying to stop using a Quarantine script, by converting
everything to MDefang.  Quarantine scans emails using the above pieces
to determine whether to block, or pass a message.  And MDefang works for
me because I can strip attachments, but I don't know how to make it work
with a) the above (LONG) regexp, and b) have it scan the body of the
message like the above matches are setup.  Ideas anyone?

--
W | I haven't lost my mind; it's backed up on tape somewhere.
  +--------------------------------------------------------------------
  Ashley M. Kirchner <mailto:ashley at pcraft.com>   .   303.442.6410 x130
  IT Director / SysAdmin / WebSmith             .     800.441.3873 x130
  Photo Craft Laboratories, Inc.            .     3550 Arapahoe Ave. #6
  http://www.pcraft.com ..... .  .    .       Boulder, CO 80303, U.S.A.