On Tue, Apr 26, 2022 at 04:04:13PM +0300, Henrik K wrote:
> On Tue, Apr 26, 2022 at 02:35:25PM +0200, Matus UHLAR - fantomas wrote:
> > Hello,
> >
> > is it possible to match message headers in rfc822 atttachments?
> >
> > from what I know, "header" rules only apply to mail headers and mimeheader
> > only apply to mime headers.
> >
> > body and rawbody afaik only search in bodies of messages or included
> > messages.
> >
> > I have asked some time ago but no success:
> >
> > https://marc.info/?l=spamassassin-users&m=132282473328809&w=2
> >
> > is this possible now or do we need out-of SA solution for this?
>
> full FOO /\nContent-Type:
> message\/rfc822.*?\nReceived:(?:[^\n]+\n\s+){0,3}[^\n]*\b1.2.3.4\b/s
Maybe a bit safer version that doesn't log huge strings and run wild
full FOO /^(?=.*?\nContent-Type:
message\/rfc822.{0,1024}?\nReceived:(?:[^\n]{1,100}\n\s{1,100}){0,3}[^\n]{0,100}\b1\.2\.3\.4\b)/s
