> And my suggested alternative should probably be adjusted in the same
> manner.
>
> Any comment on what I suggested (the 1 LE + 0 GT approach)?
Yup, it needs the same adjustment as I just explained, a minimum of at
least 2 chars.
On Fri, 2011-11-25 at 10:52 -0800, John Hardin wrote:
> rawbody __RB_LE_200 /^.{,200}$/s
/^.{2,200}$/s
> tflags __RB_LE_200 multiple maxhits=2
> rawbody __RB_GT_200 /^.{201}/s
> meta __BODY_LE_200 (__RB_LE_200 == 1) && !__RB_GT_200
>
> If there's only one short line in the body, and no long lines, the entire
> body is short.
Whether this version or my adjusted original rule fits best depends on
what to match exactly. This variant e.g. will not match on a very short
HTML message with text/plain as an alternative MIME-part.
Unlike my adjusted original, this rule, however, will NOT trigger on
long-ish messages with a *single* short MIME-part. Mailing-list footers
come to mind, or any other short textual MIME-part in a mixed structure.
IIRC Apple mail e.g. loves to do that with text and attachments.
I guess this is the saver variant.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
