https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7992

            Bug ID: 7992
           Summary: Capturing and reusing strings for matching across
                    rules
           Product: Spamassassin
           Version: 4.0.0
          Hardware: All
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P2
         Component: Libraries
          Assignee: dev@spamassassin.apache.org
          Reporter: apa...@hege.li
  Target Milestone: Undefined

There was some talk on dev-list a year ago about capturing strings from rules
and using them in other rules.

https://lists.apache.org/thread/8tz6dhjfmy1kc71168djwt5ow3h88dfp

It wasn't actually hard to do, made a quick version of it. So far it works
across any body, rawbody, full, uri or header rule.

Capture From-host to FROMHOST variable using Perl named capture (?<VAR>string):
 header CAPTEST1 From =~ /@(?<FROMHOST>[\w.]+)/

Use """VARIABLE""" template in regex:
 body CAPTEST2 /\b"""FROMHOST"""\b/

Example:

echo -e "From: <f...@bar.com>\n\nHello from bar.com" | \
 SA_LOGGER_ESCAPE=0 spamassassin \
 --cf 'header CAPTEST1 From =~ /@(?<FROMHOST>[\w.]+)/' \
 --cf 'body CAPTEST2 /\b"""FROMHOST"""\b/' -t -L -D rules,rules-all 2>&1 | \
 grep CAPTEST

dbg: rules: ran header rule CAPTEST1 ======> got hit: "@bar.com"
dbg: rules-all: running body rule CAPTEST2
dbg: rules-all: replaced regex capture template: CAPTEST2, FROMHOST,
(?^aa:\b(?:bar\.com)\b)
dbg: rules: ran body rule CAPTEST2 ======> got hit: "bar.com"

It works by adjusting priority of any rule that has named captures to -10000,
so they are "guaranteed" to run before any rules that have templates. Of course
there could be rules that have _both_ captures and templates, like chained
rules, but in that case one could adjust priorities manually so things run in
required order.

The """\w""" template format can be changed to something else if desired. I
just came up with something that shouldn't appear in any normal rules or
ReplaceTags. I'd rather not require any extra effort like "capture_rules
CAPTEST1" (similar to replace_rules), but feel free to rebut.

-- 
You are receiving this mail because:
You are the assignee for the bug.

Reply via email to