>I know regex fairly well hmm.....
from\:.*\_ looks very bad - it is read like: look for from: followed by anything any long (or nothing) followed by _ in the complete header keep in mind: all bombRE's are using the /s regex switch (ignoring CR and LF) So, if there is an underscore anywhere after from: in the mail header, the regex will match: use (?:^|\n)from:\s*_+ instead (collon and underscore don't need to be escaped here . but can be) is read like: look for at the start or after each newline from: followed by any count of CR,LF,SPACE,TAB (or nothing) followed by any count (but at least one) of _ in the complete header in your bombHeaderRe the line should be: ~(?:^|\n)from:\s*_+~=>60 the tilds are required in assp because of the used pipe (|) in the regex Thomas Von: "Scott MacLean" <a...@hollsco.com> An: "K Post" <nntp.p...@gmail.com>, "ASSP Development Mailing List" <assp-test@lists.sourceforge.net> Datum: 07.06.2022 19:22 Betreff: Re: [Assp-test] bombHeaderRe matching every email No, I did not. I know regex fairly well, and this to me looks like a bug or otherwise unintentional operation. I've commented out these lines in my BombHeader for now. On 6/7/2022 10:58, K Post wrote: > Hi Scott, > Did you ever figure this out? > I'm no regex wiz like Thomas is, but what you have appears pretty simple > to me -- and I don't see anything wrong with it... > I tried > > from\:.*\_ > > in testRE and see it matching everything too. I don't understand why. > I know this doesn't help you with why this is happening, but figured > that it would at least help to hear that you're not the only one whose > system generates that result. > > > > On Wed, Jun 1, 2022 at 5:32 PM Scott MacLean <a...@hollsco.com > <mailto:a...@hollsco.com>> wrote: > > I've been seeing a bunch of spam getting through my filter recently, > and > they all have the same thing in common: an underscore at the beginning > of the "From" and/or "Subject" lines. This should be really easy to > pick > up with bombHeaderRe, but something's not working. > > Here's an example of the spam I'm seeing: > > From:_Male Health > <support-team_0rk47mtncmz9bfpalcklzzn...@offer.market.ca > <mailto:support-team_0rk47mtncmz9bfpalcklzzn...@offer.market.ca>> > Subject:_Size matters and we can help > > Sometimes there is a space in between the colon and the underscore, > usually there is not. > > Here is the regex I added to my bombHeaderRe: > > From\:.*\_=>60 > Subject\:.*\_=>60 > > However, I quickly realized that this was tagging EVERY email coming > through the server! For instance, here's an email: > > From: Readly <rea...@news.readly.com <mailto:rea...@news.readly.com >> > > And looking at mail analysis, it's being caught by this regex, even > though there is no underscore: > > BombHeader RE: 'highest match: "(matchlength:84) From: Readly > <readly@news.readly" with valence: 60 - PB value = 60' > matching bombHeaderRe(file:files/bombheaderre.txt[line 188]): > 'From\:.*_' > > Any idea what's going wrong and causing this? > > > > > _______________________________________________ > Assp-test mailing list > Assp-test@lists.sourceforge.net < mailto:Assp-test@lists.sourceforge.net> > https://lists.sourceforge.net/lists/listinfo/assp-test > <https://lists.sourceforge.net/lists/listinfo/assp-test> > _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test DISCLAIMER: ******************************************************* This email and any files transmitted with it may be confidential, legally privileged and protected in law and are intended solely for the use of the individual to whom it is addressed. This email was multiple times scanned for viruses. There should be no known virus in this email! *******************************************************
_______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
