On Mon, 6 Jul 2009, info-spamassassin-t...@cs.utexas.edu wrote:
I seem to be having a hard time writing rules which anchor a string to the start of the line in the body of a text message. e.g., suppose I get a lot of phish which contain text (not html) like this: Username:.......... Password:..........
You might want to look at the FILL_THIS_FORM stuff I posted in the last few days.
I try what seemed intuitively easy: body __PHISH1 /^Password\b/i body __PHISH0 /^Username\b/i meta PHISH __PHISH1 && __PHISH0 But the rule does not hit unless I remove the '^' from the above regex. What am I missing?
...that body rules work on a "cleaned-up" body. Lines that look like they should make up a paragraph are joined together and whitespace is collapsed.
Add this to your testbed and run with "--debug area=all,rules" to see what it's _really_ comparing to for body rules:
body ALL_BODY /.+/ You also need a "m" flag. :) -- John Hardin KA7OHZ http://www.impsec.org/~jhardin/ jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- The big news on the streets today is that the people of Baqubah are generally ecstatic, although many hold in reserve a serious concern that we will abandon them again. For many Iraqis, we have morphed from being invaders to occupiers to members of a tribe. -- Michael Yon, 05 July 2007 ----------------------------------------------------------------------- Tomorrow: Robert Heinlein's 102nd birthday
