Hi David and Andrew Do you know if Declude is always able to extract the decoded URL from text and/or HTML bodies?
I have stored an text example including headers, text and body part on https://drive.google.com/file/d/0B1ufBZotBQdwZXlLQ2pjM2tzZlU/view?usp=sharing The previously mentioned regex hasn't triggered for this URL. I fear it's because the URL has a line break in the body parts and contains encoded = characters (=3D) So I wonder what form of URL Declude can extract from this message. And if he does extract both the text and the html URL or only one? Thanks in advance Markus Von: community@mailsbestfriend.com [mailto:community@mailsbestfriend.com] Im Auftrag von Markus Gufler | Limitis Gesendet: Donnerstag, 6. Oktober 2016 10:54 An: community@mailsbestfriend.com Betreff: [MBF] AW: another question about PCRE Hi David, Andrew Thank you for your feedback. Finally I found out why this filter hasn't triggered before in my NEWFILTER file I use to test new patterns. I comment out older tests but keep them in the file including all my comments. In this case I missed to disable the following line _below_ the current investigation (the PCRE for this link) HEADERS END NOTCONTAINS Subject: =?utf-8 So just for your information: Such an END statement will end the test sequence of this filter file WITHOUT adding any points already triggered before. (in my case the PCRE signature for the link) Instead of completely avoiding END statements in the middle of a filter file you can use a STOPATFIRSTHIT on top of the filter file in order to let count at least that first triggered line. Kind regards and thanks again Andrew for the little RegEx course... Markus Von: community@mailsbestfriend.com<mailto:community@mailsbestfriend.com> [mailto:community@mailsbestfriend.com] Im Auftrag von David Barker | Mail's Best Friend | 1-866-919-2075 Gesendet: Mittwoch, 5. Oktober 2016 16:16 An: community@mailsbestfriend.com<mailto:community@mailsbestfriend.com> Betreff: [MBF] Re: another question about PCRE I need to see the exact line from your Filter. I want to make sure the syntax is correct as the regex itself looks like it should be working. From: community@mailsbestfriend.com<mailto:community@mailsbestfriend.com> [mailto:community@mailsbestfriend.com] On Behalf Of Markus Gufler | Limitis Sent: Tuesday, October 4, 2016 11:51 PM To: community@mailsbestfriend.com<mailto:community@mailsbestfriend.com> Subject: [MBF] Re: another question about PCRE I'm mobile at the moment but it's BODY 77 PCRE followed by one of the two regex in the links. Am 05.10.2016 5:30 vorm. schrieb David Barker | Mail's Best Friend | 1-866-919-2075 <david.bar...@mailsbestfriend.com<mailto:david.bar...@mailsbestfriend.com>>: Can you send me the exact line in your filter for Declude. From: community@mailsbestfriend.com<mailto:community@mailsbestfriend.com> [mailto:community@mailsbestfriend.com] On Behalf Of Markus Gufler | Limitis Sent: Tuesday, October 4, 2016 4:06 AM To: community@mailsbestfriend.com<mailto:community@mailsbestfriend.com> Subject: [MBF] another question about PCRE Hi all I try to catch URLs like these (screenshot) [cid:image001.jpg@01D21E8E.575CE220] I tried to do this with two variants of a regex https://regex101.com/r/i3TVSc/1 and https://regex101.com/r/zdJ5r5/1 but both seems not being triggered within Declude. Any idea? Markus
