> -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > Sent: Tuesday, November 22, 2005 7:35 AM > To: [email protected] > Subject: rules and new line > > I've got some spam mails that has this kind of pattern > > A > Q > s > G > T > Ue > O > > I've tried to make a rule but \n doesen't work with > spamassassin. Can anyone give me some advice or an example to > catch this kind of spam? >
Well, it depends on the content type of the message. If the content-type is text/html, you have to use a full test with the /s flag. Not the most elegant (or efficient) test, but currently it's the only way to go. At least until there is a better mechanism for doing multiline rawbody (see http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4691). full BROKEN_TEXT /A\nQ\ns\nG\nT\nUe\nO/s score BROKEN_TEST 1.0 If the content type is text/plain, then you can use a body rule... Because newlines get wrapped up by get_body() call, the resulting lines look like this... @4000000043832c1129eb21ec [7938] dbg: generic: A Q s G T Ue O So your rule would look like this... body BROKEN_TEXT_BODY /A Q s G T Ue O/ score BROKEN_TEST_BODY 1.0 I tested, and both rules work against your sample... Although the body rule depends on Content-Type text/plain. # cat message.txt | spamc X-Spam-Tests: AWL,BROKEN_TEXT,BROKEN_TEXT_BODY,MISSING_SUBJECT,NO_RECEIVED, NO_RELAYS,TO_CC_NONE Thanks, Dallas
