On Sun, 2010-02-28 at 12:00 -0500, Mark London wrote: > Hi - I created a FULL rule that works fine with html in plain text. > However, if the html is base64 encoded, FULL rules don't appear to > work. A RAWBODY rule doesn't work either, because it doesn't ignore > line breaks. Any ideas?
full rules don't ignore line breaks either, do they? Anyway, if you want to treat line breaks just like any other whitespace and therefor possibly apply your rules to multi-line strings, have a look at the /m and /s RE modifiers. http://perldoc.perl.org/perlre.html#Modifiers You don't need a special parsed or decoded message -- you can extend your rule's RE. Note that in this case proper bounding becomes even more crucial, since the string to match against can be quite long. Don't use unbound quantifiers like * and + unless absolutely necessary, but try to always limit matching by using an upper bound quantifier, like {1,80}. -- char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
