[Mimedefang] SpamAssassin regexp question

[Joseph Brennan]

># This mail was sent by...
> rawbody UAH_SENTBY1 /^This email was sent by:$/
> score UAH_SENTBY1 1.0
> rawbody UAH_SENTBY2 /^Unsubscribe: http:.+\/accounts$/
> score UAH_SENTBY2 1.0
>
> When I ran command line spamassassin against a copy of the message, the
> tests did not hit.  When I changed it to this:
>
># This mail was sent by...
> rawbody UAH_SENTBY1 /\nThis email was sent by:\n/
> score UAH_SENTBY1 1.0
> rawbody UAH_SENTBY2 /\nUnsubscribe: http:.+\/accounts\n/
> score UAH_SENTBY2 1.0
>
> they did.  What's the difference?  Thanks...



The symbols ^ and $ do not always mean start and end of line.  They
mean start and end of the chunk perl is working with, which can be
changed by redefining $/.  SpamAssassin seems to read the whole
message in one chunk, so that it can match across lines.

I just wrote the same rule yesterday.  There's always a 1 or 2 letter
directory above /accounts so I included that.

body CU_SENTBY          /This email was sent by:/
body CU_ACCOUNTS        /Unsubscribe: 
http:.{40,80}\/[A-Za-z]{1,2}\/accounts/


Joseph Brennan
Columbia University Information Technology