Guys, remember that if you use /^foo/ with body or rawbody, you most likely
need to use /m !!!

Fixed few blatant ones, theres many more, atleast check these out

rulesrc/sandbox/felicity/70_other.cf:body TVD_DEAR_HOMEOWNER         /^dear 
homeowner/i
rulesrc/sandbox/felicity/70_other.cf:body TVD_LONG_WORD5             
/^(?:(?:\w+,?\s+)\.)+\s*$/
rulesrc/sandbox/felicity/70_other.cf:body TVD_SPACED_WORDS   
/^(?:[A-Z]\s)+[a-z]\s(?:[A-Z]\s)+$/
rulesrc/sandbox/jm/20_basic.cf:body __BODY_STARTS_WITH_FROM_LINE /^From \S+ 
\S\S\S \S\S\S .. ..:..:.. \S+\s+\S+\: /s
rulesrc/sandbox/jm/20_basic.cf:rawbody __HS_QUOTE /^> /
rulesrc/sandbox/fanf/30_text.cf:rawbody IMG_ALT_BRACKETS /^<img 
src="cid:7\.1\.0\.9\.[^"]+\.0" width=\d+ height=\d+ alt="[[][]]">/
rulesrc/sandbox/khopesh/20_khop_general.cf:body  DEAR_EMAIL 
/^\s*Dear\b.{0,70}\w\@\w/i
rulesrc/sandbox/jhardin/20_MIME_in_body.cf: body        __MIME_CTYPE_IN_BODY    
/^Content-Type:\s/
rulesrc/sandbox/jhardin/20_misc_testing.cf:body           DEAR_EMAIL_USER       
   /^\s?(?:Dear\s|Attention:?\s?)(?:E|Web)-?mail\s(?:account\s)?User\b/i
rulesrc/sandbox/jhardin/20_misc_testing.cf:body        __FBI_BODY_SHOUT_1   
/^FEDERAL BUREAU OF INVESTIGATIONS?\b/
rulesrc/sandbox/jhardin/20_misc_testing.cf:body        __BODY_TEXT_LINE     
/^\s*\S/
rulesrc/sandbox/jhardin/20_misc_testing.cf:body        __SINGLE_WORD_LINE  
/^\s?\S{1,60}\s?$/
rulesrc/sandbox/dos/70_other.cf:body __DOS_HI                   /^Hi,$/
rulesrc/sandbox/maddoc/99_doc_test.cf:rawbody __TWO_WORD_LINES /^\S+\s+\S+$/
rulesrc/sandbox/maddoc/99_fsl_testing.cf:rawbody  FSL_BOTSPAM_1   
/^[^\n]+\nhttp:\/\/[^\n]+\.ru\/\n$/s

Remember that body always has a subject line as first line, many of these
are basically trying to match only subject...



On Wed, Aug 07, 2019 at 12:45:49PM -0000, h...@apache.org wrote:
> Author: hege
> Date: Wed Aug  7 12:45:49 2019
> New Revision: 1864618
> 
> URL: http://svn.apache.org/viewvc?rev=1864618&view=rev
> Log:
> Fix some missing regex /m
> 
> Modified:
>     spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf
>     spamassassin/trunk/rulesrc/sandbox/jm/20_basic.cf
> 
> Modified: spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf
> URL: 
> http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf?rev=1864618&r1=1864617&r2=1864618&view=diff
> ==============================================================================
> --- spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf (original)
> +++ spamassassin/trunk/rulesrc/sandbox/billcole/80_test.cf Wed Aug  7 
> 12:45:49 2019
> @@ -1,19 +1,19 @@
>  # These are oddities seen in Other People's Spam, i.e. I have no hits in my 
> test corpora 
>  
>  describe     __HAS_IMG_SRC   Has an img tag on a non-quoted line
> -rawbody              __HAS_IMG_SRC   /^[^>].*?<img src=/i
> +rawbody              __HAS_IMG_SRC   /^[^>].*?<img src=/im
>  tflags               __HAS_IMG_SRC   multiple maxhits=100
>  
>  describe     __HAS_HREF      Has an anchor tag with a href attribute in 
> non-quoted line
> -rawbody              __HAS_HREF      /^[^>].*?<a href=/i
> +rawbody              __HAS_HREF      /^[^>].*?<a href=/im
>  tflags               __HAS_HREF      multiple maxhits=100
>  
>  describe     __HAS_IMG_SRC_ONECASE   Has an img tag on a non-quoted line 
> with consistent case
> -rawbody              __HAS_IMG_SRC_ONECASE   /^[^>].*?<(img src|IMG SRC)=/
> +rawbody              __HAS_IMG_SRC_ONECASE   /^[^>].*?<(img src|IMG SRC)=/m
>  tflags               __HAS_IMG_SRC_ONECASE   multiple maxhits=100
>  
>  describe     __HAS_HREF_ONECASE      Has an anchor tag with a href attribute 
> in non-quoted line with consistent case
> -rawbody              __HAS_HREF_ONECASE      /^[^>].*?<(a href|A HREF)=/
> +rawbody              __HAS_HREF_ONECASE      /^[^>].*?<(a href|A HREF)=/m
>  tflags               __HAS_HREF_ONECASE      multiple maxhits=100
>  
>  describe     __MIXED_IMG_CASE        Has img tags with mixed-up cases in 
> non-quoted lines
> 
> Modified: spamassassin/trunk/rulesrc/sandbox/jm/20_basic.cf
> URL: 
> http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jm/20_basic.cf?rev=1864618&r1=1864617&r2=1864618&view=diff
> ==============================================================================
> --- spamassassin/trunk/rulesrc/sandbox/jm/20_basic.cf (original)
> +++ spamassassin/trunk/rulesrc/sandbox/jm/20_basic.cf Wed Aug  7 12:45:49 2019
> @@ -31,7 +31,7 @@ header JM_RCVD_QMAILV1     Received =~ /
>  #   From addr...@example.com  Mon Jun 19 14:15:23 2006
>  #   Header2: blah
>  
> -body __BODY_STARTS_WITH_FROM_LINE /^From \S+ \S\S\S \S\S\S .. ..:..:.. 
> \S+\s+\S+\: /s
> +body __BODY_STARTS_WITH_FROM_LINE /^(?:[^\n]*\n)?From \S+ \S\S\S \S\S\S .. 
> ..:..:.. \S+\s+\S+\: /s
>  meta CORRUPT_FROM_LINE_IN_HDRS (MISSING_HEADERS && 
> __BODY_STARTS_WITH_FROM_LINE && MISSING_DATE && NO_RELAYS)
>  describe CORRUPT_FROM_LINE_IN_HDRS Informational: message is corrupt, with a 
> From line in its headers
>  
> 

Reply via email to