[Mimedefang] SA - MIME attachments?

Joseph Brennan brennan at columbia.edu
Thu Oct 27 09:35:52 EDT 2005



--On Wednesday, October 26, 2005 22:33 -0600 Jon Fullmer 
<jon at jonfullmer.com> wrote:


> body       PORN_SPAM       /(?:porn.com|porn-site.com|pr0n.com)/I
> describe   PORN_SPAM      Some jerk sending me porn spam
> score PORN_SPAM 10.0
>
> I've noticed that when I do this, though, if the e-mail is a multipart
> MIME message (with, say, one part "text/plain" and one part "text/html"),
> it won't find the string I'm having it search for.  In the above example,
> if some "text/html" portion of the message contains "porn.com", the rule
> won't be tripped.
>
> Obviously, I wouldn't want to search ALL MIME parts, as some may be
> images, etc., but is there a way I can tell SA to search text/plain and
> text/html parts (as well as the standard message body)?


I think SA does search only text parts.

I may have forgotten something but it looks like that regexp requires
the string '?:porn.com' rather than just 'porn.com'.

Joseph Brennan
Columbia University Information Technology











More information about the MIMEDefang mailing list