You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by twofers <tw...@yahoo.com> on 2009/07/16 13:57:51 UTC
Underscores
How can I pattern match when every word has an underscore after it.
Example:
This_sentenance_has_an_underscore_after_every_word
I'm not really good at Perl pattern matching, but \w and \W see an underscore as a word character, so I'm just not sure what might work.
body =~ /^([a-z]+_+)+/i
Is that something that will work effectively?
Thanks.
Wes
Re: Underscores
Posted by John Hardin <jh...@impsec.org>.
On Thu, 16 Jul 2009, Karsten Br�ckelmann wrote:
>> Whoops! Make that:
>>
>> /(?:[^_]{1,30}_+){5}/
>
> Better. ;) However, while that indeed eliminates excessive backtracking
> as \S or \w results in (since they contain the underscore), this doesn't
> match "words ending in underscores". A non-underscore [^_] includes
> space, punctuation, and any other unwanted char.
>
> Exactly _five_ occurrences of an '_' underscore, with up to 30 _random_
> chars in between. This paragraph matches. :)
Sorry. I lost sight of that part...
/(?:[^_\s]{1,30}_+){5}/
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
You know things are bad when Pravda says we [the USA] have gone
too far to the left. -- Joe Huffman
-----------------------------------------------------------------------
Today: the 64th anniversary of the dawn of the Atomic Age
Re: [sa] Re: Underscores
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Thu, 2009-07-16 at 11:08 -0400, Charles Gregory wrote:
> Given that OP said the entire *line* was word-underscore-word-underscore,
> then why not just:
>
> body R01 /^\w{30,}$/m
Indeed, it really depends on what *exactly* the rule should match.
> Or perhaps the OP wasn't clear on whether 'word' might contain other
> punctuation, and so we might simply use:
>
> body R02 /^\S{30,}$/m
This one also matches a long-ish URL on a line of its own.
> I might add \s* at the end of the rule, just in case of trailing spaces...
Keep in mind, that with body rules, the body is *rendered*. Whitespace
normalized, and *paragraphs* re-flowed to a single string with embedded
newlines stripped. For instance, this very paragraph is a single ^line$
as far as body REs are concerned.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: [sa] Re: Underscores
Posted by Charles Gregory <cg...@hwcn.org>.
On Thu, 16 Jul 2009, Karsten Bräckelmann wrote:
>> /(?:[^_]{1,30}_+){5}/
> Better. ;) However, while that indeed eliminates excessive backtracking
> as \S or \w results in (since they contain the underscore), this doesn't
> match "words ending in underscores". A non-underscore [^_] includes
> space, punctuation, and any other unwanted char.
Given that OP said the entire *line* was word-underscore-word-underscore,
then why not just:
body R01 /^\w{30,}$/m
Or perhaps the OP wasn't clear on whether 'word' might contain other
punctuation, and so we might simply use:
body R02 /^\S{30,}$/m
I might add \s* at the end of the rule, just in case of trailing spaces...
- C
Re: Underscores
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
> Whoops! Make that:
>
> /(?:[^_]{1,30}_+){5}/
Better. ;) However, while that indeed eliminates excessive backtracking
as \S or \w results in (since they contain the underscore), this doesn't
match "words ending in underscores". A non-underscore [^_] includes
space, punctuation, and any other unwanted char.
Exactly _five_ occurrences of an '_' underscore, with up to 30 _random_
chars in between. This paragraph matches. :)
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Underscores
Posted by John Hardin <jh...@impsec.org>.
On Thu, 2009-07-16 at 06:27 -0700, John Hardin wrote:
> How about:
>
> /(?:[^_]{1,30}_+){1,5}/
Whoops! Make that:
/(?:[^_]{1,30}_+){5}/
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
Re: Underscores
Posted by John Hardin <jh...@impsec.org>.
On Thu, 2009-07-16 at 08:52 -0400, Matt Kettler wrote:
>
> twofers wrote:
> > How can I pattern match when every word has an underscore after it.
> > Example:
> > This_sentenance_has_an_underscore_after_every_word
> >
> > body =~ /^([a-z]+_+)+/i
>
> I'd do something like this:
>
> body MY_UNDERSCORES /\S+_+\S+_+\S+/
That's quite a lot of backtracking, no?
How about:
/(?:[^_]{1,30}_+){1,5}/
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
Re: Underscores
Posted by Jeff Mincy <je...@delphioutpost.com>.
From: Matt Kettler <mk...@verizon.net>
Date: Thu, 16 Jul 2009 08:52:50 -0400
twofers wrote:
> How can I pattern match when every word has an underscore after it.
> Example:
> This_sentenance_has_an_underscore_after_every_word
>
> I'm not really good at Perl pattern matching, but \w and \W see an
> underscore as a word character, so I'm just not sure what might work.
>
> body =~ /^([a-z]+_+)+/i
>
> Is that something that will work effectively?
Is this for a spam rule?
I'd do something like this:
body MY_UNDERSCORES /\S+_+\S+_+\S+/
Unless you really want to restrict it to A-Z.
Regardless, ending any regex in + in a SA rule is redundant. Since +
allows a one-instance match, it will devolve to that. You don't need to
match the entire line with your rule, so the extra matches are
redundant. It will match the first instance, and that's all it needs to
be a match.
Also any regex ending in * should just have it's last element removed,
as that will devolve to a zero-count match.
The /\S+_+\S+_+\S+/ rule will lots of technical email, for example
discussions on shell environment variables like LD_LIBRARY_PATH.
-jeff
Re: Underscores
Posted by Matt Kettler <mk...@verizon.net>.
twofers wrote:
> How can I pattern match when every word has an underscore after it.
> Example:
> This_sentenance_has_an_underscore_after_every_word
>
> I'm not really good at Perl pattern matching, but \w and \W see an
> underscore as a word character, so I'm just not sure what might work.
>
> body =~ /^([a-z]+_+)+/i
>
> Is that something that will work effectively?
>
> Thanks.
>
> Wes
>
>
I'd do something like this:
body MY_UNDERSCORES /\S+_+\S+_+\S+/
Unless you really want to restrict it to A-Z.
Regardless, ending any regex in + in a SA rule is redundant. Since +
allows a one-instance match, it will devolve to that. You don't need to
match the entire line with your rule, so the extra matches are
redundant. It will match the first instance, and that's all it needs to
be a match.
Also any regex ending in * should just have it's last element removed,
as that will devolve to a zero-count match.