You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "j.emerlik" <j....@gmail.com> on 2019/09/24 17:30:12 UTC
Re: regex rule
I am trying to catch some header field with spaces but it doesn't work eg.:
header __RULE_1 Return-Path =~ /[\s\d]{80,}/
Anyone could help or know why it's doesn't work ?
Re: regex rule
Posted by Paul Stead <pa...@gmail.com>.
A bit of anchoring wouldn't go amiss either:
header __RULE_1 X-Mozilla-Keys:raw =~ /^[\s\d]{80,}$/
Paul
On Wed, 25 Sep 2019 at 13:04, Paul Stead <pa...@gmail.com> wrote:
> You want:
>
> header __RULE_1 X-Mozilla-Keys:raw =~ /[\s\d]{80,}/
>
> note the :raw addition
>
> Paul
>
> On Tue, 24 Sep 2019 at 21:57, j.emerlik <j....@gmail.com> wrote:
>
>> Example link:
>>
>> https://pastebin.com/index/yYBSNw5x
>>
>>
>>
>> wt., 24 wrz 2019 o 19:57 John Hardin <jh...@impsec.org> napisał(a):
>>
>>> On Tue, 24 Sep 2019, j.emerlik wrote:
>>>
>>> > I am trying to catch some header field with spaces but it doesn't work
>>> eg.:
>>> > header __RULE_1 Return-Path =~ /[\s\d]{80,}/
>>> >
>>> > Anyone could help or know why it's doesn't work ?
>>>
>>> Can you provide a spample for us to take a look at (upload to pastebin,
>>> all headers must be present, and post the URL for that here)?
>>>
>>> --
>>> John Hardin KA7OHZ http://www.impsec.org/~jhardin/
>>> jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
>>> key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
>>> -----------------------------------------------------------------------
>>> An AR-15 in civilian hands used to defend a home or business:
>>> a High Velocity Assault Weapon with High Capacity Magazines
>>> An AR-15 in Law Enforcement Officer hands used to murder six kids:
>>> a Police-Style Patrol Rifle
>>> -----------------------------------------------------------------------
>>> 5 days until the 78th anniversary of the massacre at Babi Yar
>>> Disarmament enables genocide - Registration enables disarmament
>>>
>>
Re: regex rule
Posted by Paul Stead <pa...@gmail.com>.
You want:
header __RULE_1 X-Mozilla-Keys:raw =~ /[\s\d]{80,}/
note the :raw addition
Paul
On Tue, 24 Sep 2019 at 21:57, j.emerlik <j....@gmail.com> wrote:
> Example link:
>
> https://pastebin.com/index/yYBSNw5x
>
>
>
> wt., 24 wrz 2019 o 19:57 John Hardin <jh...@impsec.org> napisał(a):
>
>> On Tue, 24 Sep 2019, j.emerlik wrote:
>>
>> > I am trying to catch some header field with spaces but it doesn't work
>> eg.:
>> > header __RULE_1 Return-Path =~ /[\s\d]{80,}/
>> >
>> > Anyone could help or know why it's doesn't work ?
>>
>> Can you provide a spample for us to take a look at (upload to pastebin,
>> all headers must be present, and post the URL for that here)?
>>
>> --
>> John Hardin KA7OHZ http://www.impsec.org/~jhardin/
>> jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
>> key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
>> -----------------------------------------------------------------------
>> An AR-15 in civilian hands used to defend a home or business:
>> a High Velocity Assault Weapon with High Capacity Magazines
>> An AR-15 in Law Enforcement Officer hands used to murder six kids:
>> a Police-Style Patrol Rifle
>> -----------------------------------------------------------------------
>> 5 days until the 78th anniversary of the massacre at Babi Yar
>> Disarmament enables genocide - Registration enables disarmament
>>
>
Re: regex rule
Posted by "j.emerlik" <j....@gmail.com>.
Example link:
https://pastebin.com/index/yYBSNw5x
wt., 24 wrz 2019 o 19:57 John Hardin <jh...@impsec.org> napisał(a):
> On Tue, 24 Sep 2019, j.emerlik wrote:
>
> > I am trying to catch some header field with spaces but it doesn't work
> eg.:
> > header __RULE_1 Return-Path =~ /[\s\d]{80,}/
> >
> > Anyone could help or know why it's doesn't work ?
>
> Can you provide a spample for us to take a look at (upload to pastebin,
> all headers must be present, and post the URL for that here)?
>
> --
> John Hardin KA7OHZ http://www.impsec.org/~jhardin/
> jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
> key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
> -----------------------------------------------------------------------
> An AR-15 in civilian hands used to defend a home or business:
> a High Velocity Assault Weapon with High Capacity Magazines
> An AR-15 in Law Enforcement Officer hands used to murder six kids:
> a Police-Style Patrol Rifle
> -----------------------------------------------------------------------
> 5 days until the 78th anniversary of the massacre at Babi Yar
> Disarmament enables genocide - Registration enables disarmament
>
Re: regex rule
Posted by RW <rw...@googlemail.com>.
On Tue, 24 Sep 2019 22:02:59 +0200
j.emerlik wrote:
> example:
>
> X-Account-Key: account4
> X-Mozilla-Keys:
>
>
> Return-Path: <i2...@xxxx.com>
>
> but you can notice that after X-Mozilla-Keys: there is 81 chars
> 0x020 or 0032 (space)
>
> Rule like thet dosn't work:
> header __RULE_1 X-Mozilla-Keys =~ /[\s\d]{80,}/
Why do you want to do this? Isn't X-Mozilla-Keys added on retrieved
mail by Thunderbird?
Re: regex rule
Posted by "j.emerlik" <j....@gmail.com>.
example:
X-Account-Key: account4
X-Mozilla-Keys:
Return-Path: <i2...@xxxx.com>
but you can notice that after X-Mozilla-Keys: there is 81 chars 0x020 or
0032 (space)
Rule like thet dosn't work:
header __RULE_1 X-Mozilla-Keys =~ /[\s\d]{80,}/
this too not work
header __RULE_1 X-Mozilla-Keys =~ /[ ]{80,}/
wt., 24 wrz 2019 o 19:57 John Hardin <jh...@impsec.org> napisał(a):
> On Tue, 24 Sep 2019, j.emerlik wrote:
>
> > I am trying to catch some header field with spaces but it doesn't work
> eg.:
> > header __RULE_1 Return-Path =~ /[\s\d]{80,}/
> >
> > Anyone could help or know why it's doesn't work ?
>
> Can you provide a spample for us to take a look at (upload to pastebin,
> all headers must be present, and post the URL for that here)?
>
> --
> John Hardin KA7OHZ http://www.impsec.org/~jhardin/
> jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
> key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
> -----------------------------------------------------------------------
> An AR-15 in civilian hands used to defend a home or business:
> a High Velocity Assault Weapon with High Capacity Magazines
> An AR-15 in Law Enforcement Officer hands used to murder six kids:
> a Police-Style Patrol Rifle
> -----------------------------------------------------------------------
> 5 days until the 78th anniversary of the massacre at Babi Yar
> Disarmament enables genocide - Registration enables disarmament
>
Re: regex rule
Posted by John Hardin <jh...@impsec.org>.
On Tue, 24 Sep 2019, j.emerlik wrote:
> I am trying to catch some header field with spaces but it doesn't work eg.:
> header __RULE_1 Return-Path =~ /[\s\d]{80,}/
>
> Anyone could help or know why it's doesn't work ?
Can you provide a spample for us to take a look at (upload to pastebin,
all headers must be present, and post the URL for that here)?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
An AR-15 in civilian hands used to defend a home or business:
a High Velocity Assault Weapon with High Capacity Magazines
An AR-15 in Law Enforcement Officer hands used to murder six kids:
a Police-Style Patrol Rifle
-----------------------------------------------------------------------
5 days until the 78th anniversary of the massacre at Babi Yar
Disarmament enables genocide - Registration enables disarmament
Re: regex rule
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 24.09.19 19:30, j.emerlik wrote:
>I am trying to catch some header field with spaces but it doesn't work eg.:
>header __RULE_1 Return-Path =~ /[\s\d]{80,}/
>
>Anyone could help or know why it's doesn't work ?
It's quite probably that the Return-Path is not the part of e-mail and it's
being added when delivering mail to mailbox.
How do you run spamassassin?
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
If Barbie is so popular, why do you have to buy her friends?