Now this is really getting weird..
I am convinced you guys are correct about this, but I am still consistently hitting my rule when the <STRONG> tag is in the string vs. when it is not. I think it may be something Outlook Express 6 is doing to the message when it is sent. Doesn't make much sense to me.
<STRONG><COMMENT></COMMENT>am Rem<COMMENT>mortgage
With <strong>
SpamCheck: not spam, SpamAssassin (score=1.176, required 4.4,
AAA_MORTGAGE 2.50, BAYES_01 -1.52, HTML_70_80 0.10,
HTML_MESSAGE 0.10)
(view source)
<DIV><FONT size=2>
<P><STRONG><COMMENT></COMMENT>am
Rem<COMMENT>mortgage</P></FONT></DIV></BODY></HTML>
<COMMENT></COMMENT>am Rem<COMMENT>mortgage
Without <strong>
SpamCheck: not spam, SpamAssassin (score=-4.687, required 4.4,
BAYES_00 -4.90, HTML_60_70 0.11, HTML_MESSAGE 0.10)
(view source)
<DIV><FONT face=Arial size=2><comment>conversation</comment>am
Rem<comment>mortgage</FONT></DIV></BODY></HTML>
I tried sending as plain text from OE6 with the same text strings to see if it had something to do with the line breaks and received the exact same results.
> -----Original Message-----
> From: Kevin Peuhkurinen [mailto:[EMAIL PROTECTED]]
> Sent: Monday, June 28, 2004 2:04 PM
> To: Jason Burzenski
> Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED]
> Subject: Re: Strange Rule
>
>
> The rule triggers on this string for me.
>
>
> [EMAIL PROTECTED] wrote:
>
> > Thanks for the unanimous feedback Kevin and Matt. But if this is
> > true, why does the rule not trigger this string:
> >
> > <COMMENT></COMMENT>am Rem<COMMENT>mortgage
> >
> >
> >
> > > -----Original Message-----
> > > From: Kevin Peuhkurinen [mailto:[EMAIL PROTECTED]]
> > > Sent: Monday, June 28, 2004 12:52 PM
> > > To: Jason Burzenski
> > > Cc: [EMAIL PROTECTED]
> > > Subject: Re: Strange Rule
> > >
> > >
> > > The body test will remove the HTML tags, so that you are
> left with:
> > >
> > > am Remmortgage
> > >
> > > The second element in your test looks for "m.ortgage",
> which matches
> > > the "mmortgage" above.
> > >
> > > [EMAIL PROTECTED] wrote:
> > >
> > > >Can anyone tell me why the following string:
> > > >
> > > ><STRONG><COMMENT></COMMENT>am Rem<COMMENT>mortgage
> > > >
> > > >Matches the following rule?
> > > >
> > > >body AAA_MORTGAGE
> /m0rt|m.ortgage|Mort\sgage|m�³age/I
> > > >
> > > >I made this rule while trying to block mortgage terms with
> > > high ascii
> > > >in them and it seems to have gone berzerk. It doesn't false
> > > positive
> > > >anything and the non-high ascii portions are working
> correctly but
> > > >I cant figure out how sa is interpreting this for the life of me.
> > > >
> > > >
> > > >
> > >
> >
>
