Hi all, I hope someone can help me with a rule I'm trying to write. My understanding of the multi-line mode, with the /m switch at the end, is this: in this mode, the caret (^) and dollar ($) match before and after newlines in the string. Is that correct?
I believe this is the correct method for allowing me to use a "full" rule (ie. searching the entire undecoded message) but also specifying carets and dollars within the regex, right? So I think this should mean that I can have some text like this, for example: Subject: this is a test From: [EMAIL PROTECTED] X-Return-Path: [EMAIL PROTECTED] ...and create a rule like the following which should hit on it: full MYRULE /^Subject:.* test$(?:\s(?!X-Return-Path).*)+\sX-Return-Path: [EMAIL PROTECTED]/m Right? If I test this rule using the Regex Coach tool at http://weitz.de/regex-coach/ (I'm on Windows), with the 'm' switch enabled, the rule works fine. But when I test it with SpamAssassin, it doesn't work and I believe it's due to the carat and dollar. However I want to specifically specify that the word "test" must be at the very end of the Subject line - hence, I want to have the $ after it. I also want to specify that the X-Return-Path must be there, which is why I have the rest of the rule the way it is, but that's not the issue. What am I doing wrong? (Of course in reality I'm not searching for the above strings, I'm trying to catch a particular spam sign, but this is a simple example of the method I'm using) Cheers, Jeremy
