Guys, remember that if you use /^foo/ with body or rawbody, you most likely need to use /m !!!
Fixed few blatant ones, theres many more, atleast check these out rulesrc/sandbox/felicity/70_other.cf:body TVD_DEAR_HOMEOWNER /^dear homeowner/i rulesrc/sandbox/felicity/70_other.cf:body TVD_LONG_WORD5 /^(?:(?:\w+,?\s+)\.)+\s*$/ rulesrc/sandbox/felicity/70_other.cf:body TVD_SPACED_WORDS /^(?:[A-Z]\s)+[a-z]\s(?:[A-Z]\s)+$/ rulesrc/sandbox/jm/20_basic.cf:body __BODY_STARTS_WITH_FROM_LINE /^From \S+ \S\S\S \S\S\S .. ..:..:.. \S+\s+\S+\: /s rulesrc/sandbox/jm/20_basic.cf:rawbody __HS_QUOTE /^> / rulesrc/sandbox/fanf/30_text.cf:rawbody IMG_ALT_BRACKETS /^<img src="cid:7\.1\.0\.9\.[^"]+\.0" width=\d+ height=\d+ alt="[[][]]">/ rulesrc/sandbox/khopesh/20_khop_general.cf:body DEAR_EMAIL /^\s*Dear\b.{0,70}\w\@\w/i rulesrc/sandbox/jhardin/20_MIME_in_body.cf: body __MIME_CTYPE_IN_BODY /^Content-Type:\s/ rulesrc/sandbox/jhardin/20_misc_testing.cf:body DEAR_EMAIL_USER /^\s?(?:Dear\s|Attention:?\s?)(?:E|Web)-?mail\s(?:account\s)?User\b/i rulesrc/sandbox/jhardin/20_misc_testing.cf:body __FBI_BODY_SHOUT_1 /^FEDERAL BUREAU OF INVESTIGATIONS?\b/ rulesrc/sandbox/jhardin/20_misc_testing.cf:body __BODY_TEXT_LINE /^\s*\S/ rulesrc/sandbox/jhardin/20_misc_testing.cf:body __SINGLE_WORD_LINE /^\s?\S{1,60}\s?$/ rulesrc/sandbox/dos/70_other.cf:body __DOS_HI /^Hi,$/ rulesrc/sandbox/maddoc/99_doc_test.cf:rawbody __TWO_WORD_LINES /^\S+\s+\S+$/ rulesrc/sandbox/maddoc/99_fsl_testing.cf:rawbody FSL_BOTSPAM_1 /^[^\n]+\nhttp:\/\/[^\n]+\.ru\/\n$/s Remember that body always has a subject line as first line, many of these are basically trying to match only subject... On Wed, Aug 07, 2019 at 12:45:49PM -0000, h...@apache.org wrote: > Author: hege > Date: Wed Aug 7 12:45:49 2019 > New Revision: 1864618 > > URL: http://svn.apache.org/viewvc?rev=1864618&view=rev > Log: > Fix some missing regex /m > > Modified: > spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf > spamassassin/trunk/rulesrc/sandbox/jm/20_basic.cf > > Modified: spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf > URL: > http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf?rev=1864618&r1=1864617&r2=1864618&view=diff > ============================================================================== > --- spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf (original) > +++ spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf Wed Aug 7 > 12:45:49 2019 > @@ -1,19 +1,19 @@ > # These are oddities seen in Other People's Spam, i.e. I have no hits in my > test corpora > > describe __HAS_IMG_SRC Has an img tag on a non-quoted line > -rawbody __HAS_IMG_SRC /^[^>].*?<img src=/i > +rawbody __HAS_IMG_SRC /^[^>].*?<img src=/im > tflags __HAS_IMG_SRC multiple maxhits=100 > > describe __HAS_HREF Has an anchor tag with a href attribute in > non-quoted line > -rawbody __HAS_HREF /^[^>].*?<a href=/i > +rawbody __HAS_HREF /^[^>].*?<a href=/im > tflags __HAS_HREF multiple maxhits=100 > > describe __HAS_IMG_SRC_ONECASE Has an img tag on a non-quoted line > with consistent case > -rawbody __HAS_IMG_SRC_ONECASE /^[^>].*?<(img src|IMG SRC)=/ > +rawbody __HAS_IMG_SRC_ONECASE /^[^>].*?<(img src|IMG SRC)=/m > tflags __HAS_IMG_SRC_ONECASE multiple maxhits=100 > > describe __HAS_HREF_ONECASE Has an anchor tag with a href attribute > in non-quoted line with consistent case > -rawbody __HAS_HREF_ONECASE /^[^>].*?<(a href|A HREF)=/ > +rawbody __HAS_HREF_ONECASE /^[^>].*?<(a href|A HREF)=/m > tflags __HAS_HREF_ONECASE multiple maxhits=100 > > describe __MIXED_IMG_CASE Has img tags with mixed-up cases in > non-quoted lines > > Modified: spamassassin/trunk/rulesrc/sandbox/jm/20_basic.cf > URL: > http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jm/20_basic.cf?rev=1864618&r1=1864617&r2=1864618&view=diff > ============================================================================== > --- spamassassin/trunk/rulesrc/sandbox/jm/20_basic.cf (original) > +++ spamassassin/trunk/rulesrc/sandbox/jm/20_basic.cf Wed Aug 7 12:45:49 2019 > @@ -31,7 +31,7 @@ header JM_RCVD_QMAILV1 Received =~ / > # From addr...@example.com Mon Jun 19 14:15:23 2006 > # Header2: blah > > -body __BODY_STARTS_WITH_FROM_LINE /^From \S+ \S\S\S \S\S\S .. ..:..:.. > \S+\s+\S+\: /s > +body __BODY_STARTS_WITH_FROM_LINE /^(?:[^\n]*\n)?From \S+ \S\S\S \S\S\S .. > ..:..:.. \S+\s+\S+\: /s > meta CORRUPT_FROM_LINE_IN_HDRS (MISSING_HEADERS && > __BODY_STARTS_WITH_FROM_LINE && MISSING_DATE && NO_RELAYS) > describe CORRUPT_FROM_LINE_IN_HDRS Informational: message is corrupt, with a > From line in its headers > >