From: "D.J. Fan" <[EMAIL PROTECTED]> Subject: Re: how to block ?1251 subject email's Date: Sun, 01 Aug 2004 19:57:51 -0600
> >In SA 2.63, header matching is always "decoded strings".
> >If you want to match undecoded header string, you have to use
> >"full" matching.
> >And, "full" matching can't use regular expression '^' (string start)
> >and '$' (string end).
> >So:
> >
> >full WIN1251SUBJECT /[\r\n]Subject: =\?Windows-1251\?B\?/
> >score WIN1251SUBJECT 8.000
> >--
>
> yoh - Would you be willing to spend a moment and explain "decoded strings"
> and "unencoded header string" or point me to somewhere that explains
> it so that I may learn.
>
> I tested this and it does work in 2.63:
> header WIN1251SUBJECT Subject =~ /Windows-1251/
> score WIN1251SUBJECT 8.000
>
> I'm not sure if you were saying it would not work or if
> you had a more proper way to do it.
In Japanese environment, we (Japanese natives) have to do that.
Below rule fails to detect ISO-2022-JP charset in 'Subject:'.
header ISO2022JPSUBJECT Subject =~ /iso-2022-jp/i
describe ISO2022JPSUBJECT Subject: =?ISO-2022-JP?B?GyRCRk03YjFjMnEbKEI=?=
score ISO2022JPSUBJECT 1.000
You can test the above rule with attatched test mail.
I think SA doesn't decode Windows-???? charset, because of a kind of locales.
And, I think the above rule is a little dangerous. Because, for example, subject is:
'Talking about spam using Windows-1251 charset'
The above subject sentence isn't encoded, but includes 'Windows-1251'. So, I think that below rule will be better:
header WIN1251SUBJECT Subject =~ /=\?Windows-1251\?[BQ]/i --
Thanks, sometimes Americans like me get near sighted.
_________________________________________________________________
MSN Toolbar provides one-click access to Hotmail from any Web page � FREE download! http://toolbar.msn.click-url.com/go/onm00200413ave/direct/01/
