The problem was multiline rules with rawbody. Changing it
to full and things work. (I missed that little detail in
the wiki, and there are body rules in the dist that have /is)
Request
A rule in-between rawbody/full? I.e. the whole body, but not the
headers? Or even better, in addition to
Because your first option matches the style inside the brackets
and
your second option does take into account the forward slash
before style?
Todd
Michael Dilworth wrote:
OK, it's late and I'm tired, and this will probably
end up being stupid regex issue, but:
why does...
rawbody
Michael Dilworth wrote on Sat, 27 Feb 2010 18:45:20 -0800:
rawbody STYLE_IN_BODY /\body\.*\style\/si not match?
because the HTML doesn't contain style? Maybe you wanted:
rawbody STYLE_IN_BODY /\body\.*\style.*\/si
Also, you don't have to escape the angle brackets, just makes the
expression
On Sat, 27 Feb 2010, Michael Dilworth wrote:
style
garbage...
/style
If you're looking for nonsense STYLE content, take a look in my sandbox.
--
John Hardin KA7OHZhttp://www.impsec.org/~jhardin/
jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org
key:
OK, it's late and I'm tired, and this will probably
end up being stupid regex issue, but:
why does...
rawbody STYLE_IN_BODY /\body\.*style/si match
and:
rawbody STYLE_IN_BODY /\body\.*\style\/si not match?
given a message body:
htmlhead
...
/headbody
...
style
garbage...
/style
...
/body
