On Thu, Sep 15, 2005 at 03:42:42PM -0400, Ronald I. Nutter wrote: > # Check for bad Re: tag > header BAD_RECOLON_TAG Subject =~ /\b"Re:"\b/i > > stopping email with something past the Re:. Is my concern valid and how > do I allow the email to get through that has something after Re: ?
I assume you want to catch Mails with 'Re:', but 'only without any further contents'? Then you'd need to use '$'(line end) instead of the second '\b'(word end) giving: header BAD_RECOLON_TAG Subject =~ /\b"Re:"$i This will be DANGEROUS IF mail-programs automatically add 'Re:' to empty Subjects! Then you'll possibly get false positives. OH, by the way, what are the double-quotes for? I think they would be seached for! So the pattern will not work as assumed? In an exim4-filter (it uses PCRE Patterns just like perl) I just wrote/tested a pattern against the 'Re...'-Spams analogous/rewritten to spamassassin: header BAD_RECOLON_TAG Subject =~ /^re:?\s*\[\d+\]:?\s*$/i Which is: re the characters :* the colon (possibly) \s* whitespace (possibly) \[ the left bracket (the typical case) \d+ one ore more digits (from 2 to 111 I saw random numbers) \] the closing bracket (all my spams had it) :? another colon (I really saw those Re:[1] and Re[2]:) \s* possibly more whitespace up to $ the end of the Subject: If anything (except more whitespace) follows the tag this pattern fails. So writing 'Re: [2] something' goes without hitting the rule. Stucki -- Christoph von Stuckrad * * |nickname |<[EMAIL PROTECTED]> \ Freie Universitaet Berlin |/_*|'stucki' |Tel(days):+49 30 838-75 459| Mathematik & Informatik EDV |\ *|if online|Tel(else):+49 30 77 39 6600| Arnimallee 2-6/14195 Berlin * * |on IRCnet|Fax(alle):+49 30 838-75454/
