>  header __SUB_CAP Subject:Capture /Your (\w+) Order/i $(__COMPANY)=\1

Would :capture play well with (e.g.) :addr, :name, :raw, etc?

It might as well be a tflag or something.  Why limit capturing to headers
only?

I hadn't intended it to be limited to headers only, but I guess the syntax woudl have to be a little different for raw, body, full, etc, since they don't have a part keyword in the rule syntax.

Originally I hadn't wanted to have the ":Capture" part, just have the capture assignment following the rule body. But then, how do you know if there is a capture assignment at the end? I didn't like the idea of trying to stick it into the match flags, especially for the (probably rare) case of multiple captures in a single rule.

I suppose that the rule scanner probably is looking past the flags that may follow a regex closing bracket, so would pick up an assignment if there was one there. So, for instance, this should work:

   body    SOME_RULE     /Your (\w+) Order/i $(__COMPANY)=\1

Alternately (which I don't much care for) we could have

   body    SOME_RULE     /Your (\w+) Order for \$(\d+)/i
   assign    __COMPANY,__AMOUNT

or keyworded

   assign    1=__COMPANY,2=__AMOUNT

What worries me about that sort of syntax is there is no real juxtapositioning requirement between a rule name definition and any modifier flag lines with the same rule name. The capture could be in a completely different rule file, and I suppose could even be before the defining rule by a thousand lines or so in a single file. But you pretty much need to see both the regex and the assignments to know what is happening to what. So allowing the assignments to be separated from the regex isn't necessarily good.

       Loren

Reply via email to