On Thu, 05 Feb 2004 20:47:41 -0600 Harry Putnam <[EMAIL PROTECTED]> wrote:
> I'd like to run a sort of push pull regex in local.cf like this: > > header To_Newsguy_Not_Reader To =~ /[EMAIL PROTECTED]/ && !/[EMAIL PROTECTED]/ > > But sa sees it as bad perl: > > Use of uninitialized value in pattern match (m//) at > /etc/mail/spamassassin/local.cf, rule To_Newsguy_Not_Reader, line 1. > > Is it possible to run this kind of dual regex? If not then how might > I phrase it in a single regex. > > I see a fair bit of spam here that doesn't raise any alarms with sa > but it has a certain characteristic. > The To field will contain address's that end in @newsguy.com but not my > address ([EMAIL PROTECTED]). However my address will appear in the > Cc: field. So you want to match an address in the To field where the domain is 'newsguy.com' and the user is anyone except 'reader', correct? Will this work?: header To_Newsguy_Not_Reader To =~ /(?<!reader)[EMAIL PROTECTED]/i describe mesg to newsguy recipient but not reader score To_Newsguy_Not_Reader 6 where (?<! ... ) is a zero-width negative look-behind assertion, a somewhat obscure bit of perl arcana found with 'perldoc perlre', which is written in some kind of crazy moon language. -- Bob
