[Mimedefang] SA - MIME attachments?
brennan at columbia.edu
Thu Oct 27 09:35:52 EDT 2005
--On Wednesday, October 26, 2005 22:33 -0600 Jon Fullmer
<jon at jonfullmer.com> wrote:
> body PORN_SPAM /(?:porn.com|porn-site.com|pr0n.com)/I
> describe PORN_SPAM Some jerk sending me porn spam
> score PORN_SPAM 10.0
> I've noticed that when I do this, though, if the e-mail is a multipart
> MIME message (with, say, one part "text/plain" and one part "text/html"),
> it won't find the string I'm having it search for. In the above example,
> if some "text/html" portion of the message contains "porn.com", the rule
> won't be tripped.
> Obviously, I wouldn't want to search ALL MIME parts, as some may be
> images, etc., but is there a way I can tell SA to search text/plain and
> text/html parts (as well as the standard message body)?
I think SA does search only text parts.
I may have forgotten something but it looks like that regexp requires
the string '?:porn.com' rather than just 'porn.com'.
Columbia University Information Technology
More information about the MIMEDefang