My rule will NOT match on "<font>blah</font>blah</font>". It WILL
match on "<font>some text</lksdk>some more text</font>"
Matthias Keller wrote:
Kevin Peuhkurinen wrote:
Something like this maybe?
#test for a string with a tag followed by 1-20 characters followed by
a closing tag followed by 1-20 characters
#followed by a closing tag that is the same as the first tag
rawbody __TEST1 /<(\S{1,20})>.{1,20}<\/\S{1,20}>.{1,20}<\/\1>/
#test for a string with a tag followed by 1-20 characters followed by
a closing tag that is the same as the first tag
#followed by 1-20 characters followed by a closing tag that is the
also same as the first tag
rawbody __TEST2 /<(\S{1,20})>.{1,20}<\/\1>.{1,20}<\/\1>/
meta TEST (__TEST1 && !__TEST2)
score TEST 0.1
Matthias Keller wrote:
Kevin Peuhkurinen wrote:
This is a tough one. AFAIK there is no way to use a single regex
to do this, so you would need multiple meta tests, sort of like
what I did with my "real name" tests
(http://www.exit0.us/index.php/KP_Rules) -- one rule to trigger on
the general pattern that you want, then another rule to trigger on
the exception.
If you could be more specific about what the purpose of the rule
is, I might be able to help more.
Matthias Keller wrote:
Still writing some cool rules for my SA (and if they prove
themself useful hopefully soon for everyone's SA) and I'm trying
something like:
match some word and if at some later position there's anything BUT
this word, return true
I'm thinking about something like this:
/([a-z]) [^\1]/i
This should for example match
asdf fdsa
asdf kdkd
asdf asd
but NOT
asdf asdf
Is that possible anyway?
Hi Kevin
Thanks for your reply
Unfortunately I didn't see any way to do this with metas so far (but
I'm still quite unexperienced with regexps....)
What I actually want to do is a rawbody test for a pattern like this:
<font>some text</lksdk>some more text</font>
So I need to test:
An opening tag, followed by some (optional) text.
Then a closing tag which is NOT the close for the first one
then some more optional text and finally the real closing tab.
I got it working ok so far but it still triggers stuff like:
<font>some text</font>some more</font>
which can occur quite often in legitimate mail (=> the second
</font> might be from a previous <font>....)
Hope that was understandable...? :)
Thanks a lot
Matt
Hi Kevin
Pretty much, with the exception that this one will produce quite a few
false positives since it matches the absolutely legal
<font>blah</font>blah</font>
That's why I NEED the first closing tag NOT to be the equal to the
first one....
Matt
