On Wed, Oct 03, 2007 at 08:46:36PM -0700, Dennis Peterson wrote:
> Any chance to set policy that requires the pattern writers anchor the
> patterns so
> they stay inside a message? I don't if the code can compile something like
> this, but
> it prevents (on first blush) spanning messages:
>
> ^.ubject: (other regex stuff here) * ^From <- space character
>
> This would stop wildcards from spanning messages. Unchecked those
No, it would not stop the regex from spanning messages. It would only
prevent it from matching the subject of the LAST message. (or from
matching ANY message if scanning individual mail files).
> wildcard characters can create very cpu intensive patterns and it may
> be they're best not used if they cannot be anchored or constrained as
> with {-50}.
That seems like a somewhat better idea. As long as the limit isn't
excessive so it can skip beyond the next header into the next message
body.
--
Jan-Pieter Cornet <[EMAIL PROTECTED]>
!! Disclamer: The addressee of this email is not the intended recipient. !!
!! This is only a test of the echelon and data retention systems. Please !!
!! archive this message indefinitely to allow verification of the logs. !!
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html
