Re: [SA] Identifying Source of False Positives -- RESOLVED

[Adam Katz <an...@khopis.com>]

Rich Shepard wrote:
> # for empty message bodies:
> body       EMPTY_BODY   m'^[^\n]+\n\s*$'
> describe   EMPTY_BODY   Message has subject but no body
> score      EMPTY_BODY   2.5

Egads ... that's an unbounded multi-line regex (that little plus sign is
quite CPU-intensive).  I don't understand its intent, either ... it
looks for a line that includes linebreaks but with no multi-line flag.
Ignoring that bug, it wants a nonzero line followed by either a blank
line or a line filled only with spaces.  How does this characterize an
empty body?  What does this have to do with the presence of a subject?

Since that regex matches nothing, I assume you meant it to be
m'^[^\n]+\n\s*$'s  or  m'^[^\n]+\n\s*$'ms

With a trailing s, that rule matches one-line emails that end in a blank
line (which are quite common).

With a trailing ms, that rule matches any email with a paragraph in it
(like this one), which is almost every single email.

It appears you wanted something like this:

body     __EMPTY_BODY  !~ m'\w\n\w's
meta     SUBJ_NO_BODY  __EMPTY_BODY && __HAS_SUBJECT
describe SUBJ_NO_BODY  Message has subject but no body
score    SUBJ_NO_BODY  2.5

Or perhaps like this:

body     EMPTY_BODY    !~ m'\w\n\w's
describe EMPTY_BODY    Message has no text in body
score    EMPTY_BODY    2.5

Also, that score seems pretty high, and I wonder about your intent.  If
you're trying to use it to catch image-only spam, please use the other
rules we've proposed on the list, like MIME_IMAGE_ONLY.

Re: [SA] Identifying Source of False Positives -- RESOLVED

[Rich Shepard <rs...@appl-ecosys.com>]

On Fri, 5 Jun 2009, Adam Katz wrote:

> Since that regex matches nothing, I assume you meant it to be
> m'^[^\n]+\n\s*$'s  or  m'^[^\n]+\n\s*$'ms

Adam,

   I didn't write this. It apparently came with the local.cf file a few years
ago.

Rich

-- 
Richard B. Shepard, Ph.D.               |  Integrity            Credibility
Applied Ecosystem Services, Inc.        |            Innovation
<http://www.appl-ecosys.com>     Voice: 503-667-4517      Fax: 503-667-8863