Would it be possible to eliminate the - number of characters between occurences - part of the rule and just look for the number of occurences? Or are we stuck with the number of characters restriction.
It's certainly *possible* to do so, as Matt posted, but it's not a good idea - in fact, there is a note at the beginning of 20_body_tests.cf specifically advising against it.
Here's why. Say you're looking for /q.*z/ - which looks very simple at first glance. Now suppose you face a 100K message with a q close to the beginning and no z anywhere. SA will start looking, find the q, and go through all 100K of the message looking for a z before it moves on to the next rule. If you have several rules like this, you'll really slow down SpamAssassin.
And if you use () around the section you'll make it even worse, because it needs to store those 100K in memory. IN SA rules, unless you're using back references you should always use (?:whatever) instead of (whatever) to let Perl know that it doesn't need to chew up the extra memory.
For this reason, none of the default body tests use ".*". In fact, the only default rules that do are header or URI tests, where you have a limited size in the first place.
Kelson Vibber
SpeedGate Communications <www.speed.net>
