Hi David and Andrew

Do you know if Declude is always able to extract the decoded URL from text 
and/or HTML bodies?

I have stored an text example including headers, text and body part on 
https://drive.google.com/file/d/0B1ufBZotBQdwZXlLQ2pjM2tzZlU/view?usp=sharing

The previously mentioned regex hasn't triggered for this URL.
I fear it's because the URL has a line break in the body parts and contains 
encoded = characters (=3D)

So I wonder what form of URL Declude can extract from this message.
And if he does extract both the text and the html URL or only one?

Thanks in advance
Markus


Von: community@mailsbestfriend.com [mailto:community@mailsbestfriend.com] Im 
Auftrag von Markus Gufler | Limitis
Gesendet: Donnerstag, 6. Oktober 2016 10:54
An: community@mailsbestfriend.com
Betreff: [MBF] AW: another question about PCRE

Hi David, Andrew

Thank you for your feedback.

Finally I found out why this filter hasn't triggered before in my NEWFILTER 
file I use to test new patterns.

I comment out older tests but keep them in the file including all my comments.
In this case I missed to disable the following line _below_ the current 
investigation (the PCRE for this link)

HEADERS             END       NOTCONTAINS Subject: =?utf-8

So just for your information:
Such an END statement will end the test sequence of this filter file WITHOUT 
adding any points already triggered before. (in my case the PCRE signature for 
the link)
Instead of completely avoiding END statements in the middle of a filter file 
you can use a STOPATFIRSTHIT on top of the filter file in order to let count at 
least that first triggered line.

Kind regards and thanks again Andrew for the little RegEx course...

Markus





Von: community@mailsbestfriend.com<mailto:community@mailsbestfriend.com> 
[mailto:community@mailsbestfriend.com] Im Auftrag von David Barker | Mail's 
Best Friend | 1-866-919-2075
Gesendet: Mittwoch, 5. Oktober 2016 16:16
An: community@mailsbestfriend.com<mailto:community@mailsbestfriend.com>
Betreff: [MBF] Re: another question about PCRE

I need to see the exact line from your Filter. I want to make sure the syntax 
is correct as the regex itself looks like it should be working.

From: community@mailsbestfriend.com<mailto:community@mailsbestfriend.com> 
[mailto:community@mailsbestfriend.com] On Behalf Of Markus Gufler | Limitis
Sent: Tuesday, October 4, 2016 11:51 PM
To: community@mailsbestfriend.com<mailto:community@mailsbestfriend.com>
Subject: [MBF] Re: another question about PCRE


I'm mobile at the moment but it's

BODY 77 PCRE

followed by one of the two regex in the links.

Am 05.10.2016 5:30 vorm. schrieb David Barker | Mail's Best Friend | 
1-866-919-2075 
<david.bar...@mailsbestfriend.com<mailto:david.bar...@mailsbestfriend.com>>:

Can you send me the exact line in your filter for Declude.



From: community@mailsbestfriend.com<mailto:community@mailsbestfriend.com> 
[mailto:community@mailsbestfriend.com] On Behalf Of Markus Gufler | Limitis
Sent: Tuesday, October 4, 2016 4:06 AM
To: community@mailsbestfriend.com<mailto:community@mailsbestfriend.com>
Subject: [MBF] another question about PCRE



Hi all



I try to catch URLs like these  (screenshot)



[cid:image001.jpg@01D21E8E.575CE220]



I tried to do this with two variants of a regex

https://regex101.com/r/i3TVSc/1

and

https://regex101.com/r/zdJ5r5/1



but both seems not being triggered within Declude.

Any idea?



Markus



Reply via email to