rawbody or body

[Tim Macrina <ti...@gmail.com>]

Can anyone explain to me what the difference is between rawbody and
body when writing spamassassin rules. I am currently using body for
most of my body rules but I did find one that was not working. I was
looking for a specific html tag and it did not work but when I changed
it to rawbody it worked. can I/should I change all my rules to use
rawbody. Thank you

Re: rawbody or body

[Matt Kettler <mk...@evi-inc.com>]

Tim Macrina wrote:
> Can anyone explain to me what the difference is between rawbody and
> body when writing spamassassin rules. 
> 

Theo, etc explained the difference between rawbody and body quite well. I won't 
re-iterate that.

 > I am currently using body for
 > most of my body rules but I did find one that was not working. I was
 > looking for a specific html tag and it did not work but when I changed
 > it to rawbody it worked. can I/should I change all my rules to use
 > rawbody.

Theo also answered this, but I wanted to clarify a bit:

No you should not change all your rules to rawbody. They'll appear to work if 
you change them to rawbody, but any HTML tag insertion obfuscations will prevent 
your rules from matching their desired text. That's not a good thing as it's a 
popular trick for spammers. Things like: "VIAG<!-- hello -->RA" will not bother 
a body rule, but a rawbody rule will be tricked by the insertion.


Only use rawbody when you want to examine HTML tags or line-break placement.

Body is for general-purpose body text checks.

full is best left for advanced tricks (qp encoding checks, etc.)

Re: rawbody or body

[Theo Van Dinter <fe...@apache.org>]

On Fri, Jul 15, 2005 at 03:14:08PM -0400, Tim Macrina wrote:
> Can anyone explain to me what the difference is between rawbody and
> body when writing spamassassin rules. I am currently using body for

It's pretty well documented, but basically there's 3 states of message:

- pristine, used for full rules, exactly how the message looks when it comes in

- raw, used for rawbody rules, if there's encoding (quoted-printable or
  base64), the text parts are decoded and concatenated together.  you still
  get all the HTML bits and such.

- rendered, used for body rules, the raw data is taken and has html parts
  decoded.  you're left with text-only.


Basically, you always want to use rendered/body, unless you need to
see HTML tags which means use a rawbody, unless you really want to see
everything including encodings which needs full.  (and if you think you
need "full" for something, you're probably better of writing a plugin,
btw.)

-- 
Randomly Generated Tagline:
I'm used to seeing people promoted ahead of me -- friends, co-workers, 
 Tibor.  I never thought it'd be my own wife.
 
 		-- Homer Simpson
 		   Marge Gets A Job

Re: rawbody or body

[Bill Landry <bi...@pointshare.com>]

----- Original Message ----- 
From: "Tim Macrina" <ti...@gmail.com>

> Can anyone explain to me what the difference is between rawbody and
> body when writing spamassassin rules. I am currently using body for
> most of my body rules but I did find one that was not working. I was
> looking for a specific html tag and it did not work but when I changed
> it to rawbody it worked. can I/should I change all my rules to use
> rawbody. Thank you

See: 
http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin_Conf.html#rule_definitions_and_privileged_settings 
for a complete description of two.

Bill