Joe Zitnik wrote:
> A couple of further questions. I was looking through your howto on the
> spamassassin site, and didn't see any info on full type rules. So where
> I would normally put header, body, etc, I'd put full, correct?
Yes.
full is a rule type that examines the full message text. I didn't cover them in
the howto because they're not commonly used. Their primary use is in examining
mime boundaries, or in examining base64 or QP encodings that both body and
rawbody rules can't see.
You can find a description of the full keyword in the Mail::SpamAssassin::Conf
manpage.
Is there
> some way I could eliminate the /Content-Disposition: attachment;.{0,30}
> portion of the rule and just search for the filename=.{0,50}\.foo\.bar/i
> portion of the rule, since because the extension is specific to our
> organization, a match on that filename would be enough?
Yes, that would in general be fine. I made it a bit more specific that needed,
with the expectation you could trim it down as desired.
Also, I thought you wanted to match "filename.foo.bar" instead of
"filename.bar", so you can ditch the \.foo part.
