You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Benny Pedersen <me...@junc.org> on 2008/04/16 16:11:25 UTC
Re: Rule writing query
On Fri, March 21, 2008 18:41, Martin Gregorie wrote:
> header MG_LINK2 Content-Disposition =~ /filename\=\"as\.zip\"/
header MG_LINK2 Content-Disposition =~ /^filename\=\"[a-z]{2}\.zip\"/i
Benny Pedersen
Need more webspace ? http://www.servage.net/?coupon=cust37098
Re: Rule writing query
Posted by Benny Pedersen <me...@junc.org>.
On Wed, April 16, 2008 16:16, Theo Van Dinter wrote:
> On Wed, Apr 16, 2008 at 04:11:25PM +0200, Benny Pedersen wrote:
>> > header MG_LINK2 Content-Disposition =~ /filename\=\"as\.zip\"/
>> header MG_LINK2 Content-Disposition =~ /^filename\=\"[a-z]{2}\.zip\"/i
> If you're trying to match the filename in an attachment, "header" isn't going
> to get you anywhere.
ups, change header to mimeheader, just maked the regexp better, atleast i hope
it was
> Look at the MIMEHeader plugin, and corresponding "mimeheader" rule type.
yes nice plugin that should be used more as default, i see alot of rules that
is mime related but still not use mimeheader plugin for testing
> Also, for this type of thing, I would probably use a plugin. AntiVirus has
> some good examples for this type of thing.
could be nice to have sanesecure sigs in clamav and have it seperated for core
sigs and test them seperately in spamassassin in the antivirus, no dont say
spamassassin is not being a antivirus program i just suggest sanesecure sigs
testing with imho is not virus anyway but the test is still nice to catch
Benny Pedersen
Need more webspace ? http://www.servage.net/?coupon=cust37098
Re: Rule writing query
Posted by Theo Van Dinter <fe...@apache.org>.
On Wed, Apr 16, 2008 at 04:11:25PM +0200, Benny Pedersen wrote:
> > header MG_LINK2 Content-Disposition =~ /filename\=\"as\.zip\"/
>
> header MG_LINK2 Content-Disposition =~ /^filename\=\"[a-z]{2}\.zip\"/i
If you're trying to match the filename in an attachment, "header" isn't going
to get you anywhere.
Look at the MIMEHeader plugin, and corresponding "mimeheader" rule type.
Also, for this type of thing, I would probably use a plugin. AntiVirus has
some good examples for this type of thing.
--
Randomly Selected Tagline:
"Can I tell you something? The seventy virgins thing -- is overdone.
Because around four or five virgins in, you're looking for a pro."
- Dennis Miller, Politically Incorrect 2002/06/19