Re: Help matching a spam (regex)

[RW]

On Tue, 4 Jun 2019 16:06:10 -0300
Marcio Vogel Merlone dos Santos wrote:

> Hi all,
> 
> Trying to match a message using uri_detail with no luck. On body I
> have something like this:
> 
> <a href="foo.bar">Something &rarr;</a>
> 
> That "something" is changed on a daily basis, so I am trying to match 
> the &rarr; which is common to all variations, and failing miserably.
> I have tried the obvious and some (desperate) variations:
> 
> uri_detail  A1_URI_FAKE_LINK    text =~ /&rarr;/i
> 
> uri_detail  A1_URI_FAKE_LINK    text =~ /.rarr;/i
> 
> uri_detail  A1_URI_FAKE_LINK    text =~ /.rarr./i
> 
> uri_detail  A1_URI_FAKE_LINK    text =~ /rarr/i
> 
> What have I missed? Thanks for any enlightenment, RTFM.
> 


&rarr represents a '→' (right arrow) character, IIWY I'd try its
UTF-8 byte sequence:

\xe2\x86\x92