[Mimedefang] SpamAssassin regexp question

[Jan Pieter Cornet]

On Thu, Aug 07, 2008 at 12:30:17PM -0500, Jim McCullars wrote:
> On Thu, 7 Aug 2008, Jan Pieter Cornet wrote:
> 
> > >> # This mail was sent by...
> > >> rawbody UAH_SENTBY1 /^This email was sent by:$/
> > >> score UAH_SENTBY1 1.0
> > >> rawbody UAH_SENTBY2 /^Unsubscribe: http:.+\/accounts$/
> > >> score UAH_SENTBY2 1.0
> > >>
> > >> When I ran command line spamassassin against a copy of the message, the
> > >> tests did not hit.  When I changed it to this:
> > >>
> > >> # This mail was sent by...
> > >> rawbody UAH_SENTBY1 /\nThis email was sent by:\n/
> > >> score UAH_SENTBY1 1.0
> > >> rawbody UAH_SENTBY2 /\nUnsubscribe: http:.+\/accounts\n/
> > >> score UAH_SENTBY2 1.0
> > >>
> > >> they did.  What's the difference?  Thanks...
> > >
> > So far, you are correct. However, spamassassin presents the "body"
> > rules with the message _per_paragraph_ (see Mail::SpamAssassin::Conf,
> > search for "body SYMBOLIC_TEST_NAME). Line breaks and html tags
> > are removed. "rawbody" tests are presented per line.
> 
>    That's what I thought, which is why I was using the rawbody tests, and
> I could never figure out why the test didn't work.  Can you shed any light
> on my specific case?  Thanks...

Err, no. I assumed that your second tests would never hit, since
they looked for a "\n" newline character at the START of the string,
and that's not supposed to be there, in the rawbody tests.

I would have assumed that the first tests would work, and the second
wouldn't.

However, I'm not that deeply familiar with spamassassin, I think the
users at spamassassin.apache.org list is a better place to ask for
guidance here.

-- 
Jan-Pieter Cornet <johnpc at xs4all.nl>
!! Disclamer: The addressee of this email is not the intended recipient. !!
!! This is only a test of the echelon and data retention systems. Please !!
!! archive this message indefinitely to allow verification of the logs.  !!