On Wed, 17 Feb 2010, Karsten Br?ckelmann wrote:
On Wed, 2010-02-17 at 08:19 -0800, John Hardin wrote:
I don't think there's any really _good_ way do what I'm trying to do in
a rawbody rule. I'm now thinking a plugin that pulls out specified HTML
tags and their contents and allows rules on them is the best way to
approach this, for example:
tagbody STYLE_GIBBERISH style =~ /^[^:;]{200}/
That actually looks useful and quite elegant, but it should be easy to
convert into a simple rawbody rule, no? Without any substantial amount
of thinking about it:
rawbody STYLE_GIBBERISH /<style[^>]*>[^:;<]{200}/im
For that simple RE yes, but more-complex REs on tag contents a rawbody
rule probably gets ugly fast.
That's where I started this, and then I ran into a situation where I
wanted to collapse whitespace, at which point things went south.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
[email protected] FALaholic #11174 pgpk -a [email protected]
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
People seem to have this obsession with objects and tools as being
dangerous in and of themselves, as though a weapon will act of its
own accord to cause harm. A weapon is just a force multiplier. It's
*humans* that are (or are not) dangerous.
-----------------------------------------------------------------------
5 days until George Washington's 278th Birthday
