You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Nicki de Wet <ni...@astcape.co.za> on 2005/06/14 14:32:11 UTC
Test not matched
Hi,
I have the following test in local.cf:
body LOCAL_OBFUS_SPAN /<SPAN style\=3D"DISPLAY: none">/i
score LOCAL_OBFUS_SPAN 0.5
The email below does not match this rule, although I don't know why. Does SA
stop executing tests after a certain point, or when certain tests are
positive?
I've test the expression with the email using an online tester,
http://samuelfullman.com/team/php/tools/regular_expression_tester_p2.php and
it works correctly.
I'm running SA 2.64 on FreeBSD.
I'll appreciate any help.
Regards,
Nicki
Return-Path: <>
Delivered-To: spam-quarantine
X-Envelope-To: <mh...@kv3.co.za>
X-Envelope-From: <Bl...@jerzy.com>
X-Quarantine-id:
<spam-948b69ba1e4fc29b5222fbd9f565c807-20050614-133137-85199-01>
Received: from jerzy.com (host68-218.pool81123.interbusiness.it
[81.123.218.68])
by ns1.astcape.co.za (Postfix) with SMTP id 9955B809A8
for <mh...@kv3.co.za>; Tue, 14 Jun 2005 13:31:35 +0200 (SAST)
From: "Bahiyya Blum" <Bl...@jerzy.com>
To: "Ngoc Milner" <mh...@kv3.co.za>
Subject: Greeat
Date: Tue, 14 Jun 2005 06:31:26 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_001A_01C570D4.9976BB00"
X-Priority: 3
X-MSMail-Priority: Normal
X-Unsent: 1
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Message-Id: <20...@ns1.astcape.co.za>
X-Spam-Status: Yes, hits=5.25 tag=1 tag2=3 kill=5 tests=BAYES_00,
DEAR_SOMETHING, FROM_ENDS_IN_NUMS, HTML_50_60, HTML_FONT_BIG, HTML_MESSAGE,
MSGID_FROM_MTA_SHORT, PRIORITY_NO_NAME, RAZOR2_CF_RANGE_51_100,
RAZOR2_CHECK
X-Spam-Level: *****
This is a multi-part message in MIME format.
------=_NextPart_000_001A_01C570D4.9976BB00
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Hello,
the circumstances of his transportation, and that he would =
welcomemisadventures.Colonel's, and there was a devil peeping out of =
them, the devil ofBut Wolverstone interposed again.well-thumbed copy of =
Horace's Odes neglected in his hands.heart of him sank at this failure =
of his bluster. Well, well, it'snot really weigh for much.I attend in =
this unhealthy island at all.islanders ashore understood still less, =
until to help their witsa ghastly smile on his white face as his eyes =
sought his sister's.That is so. I knew your colonel.before and armed =
himself with it against an emergency.he nodded, muttering, Yes, and =
again, Yes. He looked up, toAye - but those were Spaniards.was harsh as =
a file. He writhed as he spoke, and for an instanthis face.
------=_NextPart_000_001A_01C570D4.9976BB00
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2800.1106" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial>Dear Sir/Madam.</FONT></DIV>
<DIV><FONT face=3DArial></FONT> </DIV>
<DIV><FONT face=3DArial>We ar<SPAN style=3D"DISPLAY: none"> potboy </SPAN>e
=
pleased to introduce ourselves as one of the leading online ph<SPAN =
style=3D"DISPLAY: none"> oblivious </SPAN>armaceutical =
shops.</FONT></DIV>
<DIV><FONT face=3DArial size=3D4></FONT> </DIV>
<DIV><FONT face=3DArial size=3D4>Save over 75<SPAN style=3D"DISPLAY: none">
=
razzle </SPAN> Percent On Meds today with </FONT><A =
href=3D"http://www.expht.donlittlbiof.com"><FONT face=3DArial =
size=3D4>MedzMail <SPAN style=3D"DISPLAY: none"> beastliness =
</SPAN>Shop</FONT></A></DIV>
<DIV> </DIV>
<TABLE cellSpacing=3D0 cellPadding=3D0 border=3D0>
<TBODY>
<TR vAlign=3Dbottom>
<TD rowSpan=3D2><FONT face=3DArial size=3D4>Vl<SPAN style=3D"DISPLAY: =
none"> dittany </SPAN>A</FONT></TD>
<TD></TD>
<TD rowSpan=3D2><FONT face=3DArial size=3D4>R<SPAN style=3D"DISPLAY: =
none"> limnology </SPAN>A</FONT></TD>
<TD></TD>
<TD rowSpan=3D2><FONT face=3DArial size=3D4><SPAN style=3D"DISPLAY: =
none"> trapezium </SPAN>lAL</FONT></TD>
<TD></TD>
<TD rowSpan=3D2><FONT face=3DArial size=3D4><SPAN style=3D"DISPLAY: =
none"> inspector </SPAN>lU</FONT></TD>
<TD></TD>
<TR vAlign=3Dbottom>
<TD><FONT face=3DArial size=3D4><SPAN style=3D"DISPLAY: none"> quixotic
=
</SPAN>G</FONT></TD>
<TD><FONT face=3DArial size=3D4> <SPAN style=3D"DISPLAY: none"> =
naughty </SPAN>C</FONT></TD>
<TD><FONT face=3DArial size=3D4>I<SPAN style=3D"DISPLAY: none"> =
erethism </SPAN>S <SPAN style=3D"DISPLAY: none"> convention =
</SPAN>VAL</FONT></TD>
<TD><FONT face=3DArial size=3D4><SPAN style=3D"DISPLAY: none"> vigogne =
</SPAN>M</FONT></TD>
<TD><FONT face=3DArial size=3D4>S and many other.</FONT>
</TD></TR></TBODY></TABLE>
<DIV><FONT face=3DArial></FONT> </DIV>
<DIV><FONT face=3DArial>With each pur<SPAN style=3D"DISPLAY: none"> =
kerchieft </SPAN>chase you get:</FONT></DIV>
<DIV><FONT face=3DArial></FONT> </DIV>
<DIV>
<LI><FONT face=3DArial>Top q<SPAN style=3D"DISPLAY: none"> bleaching =
</SPAN>uaIity</FONT>
<LI><FONT face=3DArial>Best <SPAN style=3D"DISPLAY: none"> conversazione =
</SPAN>Prices</FONT>
<LI><FONT face=3DArial>Total confid<SPAN style=3D"DISPLAY: none"> Maharajah
=
</SPAN>entiaIity</FONT>
<LI><FONT face=3DArial>Home de<SPAN style=3D"DISPLAY: none"> brandish =
</SPAN>Iivery</FONT></LI></DIV>
<DIV><FONT face=3DArial></FONT> </DIV>
<DIV><FONT face=3DArial>Have a nice day.</FONT></DIV></BODY></HTML>
------=_NextPart_000_001A_01C570D4.9976BB00--
Re: Test not matched
Posted by Nicki de Wet <ni...@astcape.co.za>.
Hi,
I figured it out. Quoting/escaping is your friend.
rawbody LOCAL_OBFUS_SPAN /<SPAN style\=.*\"DISPLAY: none\">/i
score LOCAL_OBFUS_SPAN 0.5
Regards,
Nicki
Re: Test not matched
Posted by Nicki de Wet <ni...@astcape.co.za>.
Thanks, I also saw it in the docs now. I've changed it, and will see if the
problem persists.
Regards,
Nicki de Wet
----- Original Message -----
From: "Matt Kettler" <mk...@comcast.net>
To: "Nicki de Wet" <ni...@astcape.co.za>; <us...@spamassassin.apache.org>
Sent: Tuesday, June 14, 2005 4:12 PM
Subject: Re: Test not matched
That's an HTML tag, you have to use rawbody, not body. body rules are run
after all HTML tags are removed from the message.
Re: Test not matched
Posted by Matt Kettler <mk...@comcast.net>.
At 08:32 AM 6/14/2005, Nicki de Wet wrote:
>I have the following test in local.cf:
>
>body LOCAL_OBFUS_SPAN /<SPAN style\=3D"DISPLAY: none">/i
>score LOCAL_OBFUS_SPAN 0.5
That's an HTML tag, you have to use rawbody, not body. body rules are run
after all HTML tags are removed from the message.
Re: Test not matched
Posted by Theo Van Dinter <fe...@apache.org>.
On Tue, Jun 14, 2005 at 02:32:11PM +0200, Nicki de Wet wrote:
> body LOCAL_OBFUS_SPAN /<SPAN style\=3D"DISPLAY: none">/i
>
> The email below does not match this rule, although I don't know why. Does SA
> stop executing tests after a certain point, or when certain tests are
> positive?
Body rules are run against the decoded + rendered (ie: no HTML markup) text of
the message. If you're specifically looking for HTML markup, you need to use
a rawbody rule.
--
Randomly Generated Tagline:
"Percussive Maintenance - The fine art of whacking the crap out of an
electronic device to get it working again." - Unknown