Alt text getting through

[Ray Anderson <rs...@rb-com.com>]

I made a custom rule in local.cf to score the following with 5:

describe   custom_body_checks    Custom Body Checks
score      custom_body_checks    5

rawbody     __bc_0     /%RND_ALT/I

meta     custom_body_checks     ( __bc_0 )

But it is not catching that phrase in the inbound e-mail.  (below)

Can anyone tell me why?  I have tons of other rules that get caught and marked, but this one seems to sneak by.....

Stuck on spamassassin-2.55-2.1.92 for now on a Mandrake 9.2 machine.

Thanks,

-=Ray
------------------------------------------------
Good flying never killed [an enemy] yet.
Major Edward "Mick" Mannock, RAF, WWI, 50-73 Victories


Here is a snip of the original e-mail (hope it doesn't get caught)
============= SNIP ============
X-Spam-Status: No, hits=0.1 required=3.0
	tests=HTML_MESSAGE
	version=2.55
X-Spam-Level: 
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)


------------A40863880133651
Content-Type: multipart/alternative;
     boundary="----------A95370304846963"

------------A95370304846963
Content-Type: text/plain;
        Charset = "us-ascii"
Content-Transfer-Encoding: 7bit

------- cut html crap ---------

    <td><p style="color:#FFFFFF; font-size: 1px;">
%RND_ALT%RND_ALT%RND_ALT
</p></td>

------- cut html crap ---------

------------A95370304846963
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

------- cut html crap ---------

    <td><p style="color:#FFFFFF; font-size: 1px;">
%RND_ALT%RND_ALT%RND_ALT
</p></td>

------- cut html crap ---------

------------A95370304846963--

------------A40863880133651
Content-Type:  image/gif; name="vicodinad.gif"
Content-Transfer-Encoding: base64

Re: Alt text getting through

[Matt Kettler <mk...@evi-inc.com>]

At 10:23 AM 1/28/2005, Ray Anderson wrote:
>I made a custom rule in local.cf to score the following with 5:
>
>describe   custom_body_checks    Custom Body Checks
>score      custom_body_checks    5
>
>rawbody     __bc_0     /%RND_ALT/I
>
>meta     custom_body_checks     ( __bc_0 )
>
>But it is not catching that phrase in the inbound e-mail.  (below)
>
>Can anyone tell me why?

Because you ended the __bc_0 with a /I, which isn't a valide modifier. 
Perhaps you meant lower-case /i?

try running spamassassin --lint on your rules..

$ spamassassin --lint
Bareword found where operator expected at (no file), rule __bc_0, line 1, 
near "/%RND_ALT/I"
         (Missing operator before I?)