Re: Understanding header ALL

2018-12-06 Thread Benny Pedersen
Pedro David Marco skrev den 2018-12-06 22:29: if your rule worked, it would only match FROM or TO... the great advantage of the ALL is that i "sees" all headers in one string so we can match FROM 'and' TO at the same time i know from my own rules it sometime possitive to limit data to what

Re: Understanding header ALL

2018-12-06 Thread Pedro David Marco
Thanks Benny, if your rule worked, it would only match FROM or TO... the great advantage of the ALL is that i "sees" all headers in one string so we can match FROM  'and'   TO at the same time --PedroD On Thursday, December 6, 2018, 10:23:17 PM GMT+1, Benny Pedersen wrote:

Re: Understanding header ALL

2018-12-06 Thread Benny Pedersen
Pedro David Marco skrev den 2018-12-06 21:25: headerTESTRULE2 ALL =~ /From=.*pedro.* To=.*pedro.*/ism This is a mistery... :-? header TESTRULE (From|To) =~ /\.*pedro\.*/ism dont know if it works, just my silly thinking right now

Re: Understanding header ALL

2018-12-06 Thread Pedro David Marco
Thanks Bill and John... Your words make sense to me. It seems that ALL means that SA puts all headers into a Perl string (including \n chars) and tries the regex... As John Hardin correctly states,  a dot does not match  the \n  but this is changed with the "s" regex flag.   In fact it works

Re: Understanding header ALL

2018-12-06 Thread Bill Cole
On 6 Dec 2018, at 13:36, Pedro David Marco wrote: Thanks a lot Bill.. i already considered the "multiple" flag and it did not work either...   i mean... the rule works but i only see the first line in Debug mode... Pedrod Having pondered this for a bit and looked at unhelpful docs, I

Re: Bayes underperforming, HTML entities?

2018-12-06 Thread John Hardin
On Tue, 4 Dec 2018, Amir Caspi wrote: On Dec 1, 2018, at 10:31 AM, John Hardin wrote: On Thu, 29 Nov 2018, Amir Caspi wrote: A) Could you sandbox the proposed rule change (AC_HTML_ENTITY_BONANZA_NEW) and see how it performs, including possible FPs? Done. Any preliminary results?

Re: Understanding header ALL

2018-12-06 Thread John Hardin
On Thu, 6 Dec 2018, Pedro David Marco wrote: Hi, i need some wisdom from SA monks please... Can anyone explain briefly how header ALL work? if i try a rule like this: header    TESTRULE1         ALL   =~    /.+/ism Using -D debug mode i only "see"  the first header of the email... shouldn't

Re: Understanding header ALL

2018-12-06 Thread Pedro David Marco
Thanks a lot Bill.. i already considered the "multiple" flag and it did not work either...   i mean... the rule works but i only see the first line in Debug mode... Pedrod On Thursday, December 6, 2018, 7:21:46 PM GMT+1, Bill Cole wrote: On 6 Dec 2018, at 12:52, Pedro David

Re: Understanding header ALL

2018-12-06 Thread Bill Cole
On 6 Dec 2018, at 12:52, Pedro David Marco wrote: Hi, i need some wisdom from SA monks please... Can anyone explain briefly how header ALL work? if i try a rule like this: header    TESTRULE1         ALL   =~    /.+/ism Using -D debug mode i only "see"  the first header of the email...

Understanding header ALL

2018-12-06 Thread Pedro David Marco
Hi, i need some wisdom from SA monks please... Can anyone explain briefly how header ALL work? if i try a rule like this: header    TESTRULE1         ALL   =~    /.+/ism Using -D debug mode i only "see"  the first header of the email... shouldn't i see all headers? it works nice if i check

Re: No longer just embedded =9D characters in blackmail emails.

2018-12-06 Thread John Hardin
On Wed, 5 Dec 2018, Grant Taylor wrote: On 12/5/18 5:43 PM, John Hardin wrote: Potentially, but it's hard to use something like that in regular rule REs. That sort of smarts would probably need to be in a plugin. Maybe (from my naive point of view) if not probably (from your more