Mailing List Archive: Can tests span empty lines?

Can tests span empty lines?

Feb 24, 2004, 1:33 PM

Post #1 of 9 (961 views)

Is it possible to create a test that will span empty lines? I.e. if I want to
test for the word "foo" followed by the word "bar", but the words are separated
by an empty line, is it possible to do? Nothing I've tried works, although I'm
a relative novice at this game. Thanks.

Re: Can tests span empty lines? [ In reply to ]

Matthias.Fuhrmann at stud

Feb 24, 2004, 1:42 PM

Post #2 of 9 (950 views)

On Tue, 24 Feb 2004, Mark London wrote:

> Is it possible to create a test that will span empty lines? I.e. if I want to
> test for the word "foo" followed by the word "bar", but the words are separated
> by an empty line, is it possible to do? Nothing I've tried works, although I'm
> a relative novice at this game. Thanks.

thats what you can do with meta rules:

rawbody __FIND_FOO /foo/i
rawbody __FIND_BAR /bar/i
meta FIND_FOOBAR (__FIND_FOO && __FIND_BAR )
describe LOCAL_FIND_IT gotcha
score LOCAL_FIND_IT 10.0

does this help ?

regards,
Matthias

Re: Can tests span empty lines? [ In reply to ]

Matthias.Fuhrmann at stud

Feb 24, 2004, 1:46 PM

Post #3 of 9 (947 views)

On Tue, 24 Feb 2004, Matthias Fuhrmann wrote:

> On Tue, 24 Feb 2004, Mark London wrote:
>
> > Is it possible to create a test that will span empty lines? I.e. if I want to
> > test for the word "foo" followed by the word "bar", but the words are separated
> > by an empty line, is it possible to do? Nothing I've tried works, although I'm
> > a relative novice at this game. Thanks.
>
> thats what you can do with meta rules:
>
> rawbody __FIND_FOO /foo/i
> rawbody __FIND_BAR /bar/i
> meta FIND_FOOBAR (__FIND_FOO && __FIND_BAR )
> describe LOCAL_FIND_IT gotcha
> score LOCAL_FIND_IT 10.0

oh, was wrong here :)

describe FIND_FOOBAR gotcha
score FIND_FOOBAR 10.0

regards,
Matthias

Re: Can tests span empty lines? [ In reply to ]

Feb 24, 2004, 2:04 PM

Post #4 of 9 (945 views)

Matthias Fuhrmann <Matthias.Fuhrmann <at> stud.uni-hannover.de> writes:
>
> rawbody __FIND_FOO /foo/i
> rawbody __FIND_BAR /bar/i
> meta FIND_FOOBAR (__FIND_FOO && __FIND_BAR )
> describe LOCAL_FIND_IT gotcha
> score LOCAL_FIND_IT 10.0
>
> does this help ?

That would match foo or bar anywhere in the message. I want to test for foo
followed by bar, and no other words in between, but empty lines are ok.

Re: Can tests span empty lines? [ In reply to ]

kaede.news at online

Feb 24, 2004, 2:36 PM

Post #5 of 9 (948 views)

Mark London <mrl@psfc.mit.edu> writes:

> Is it possible to create a test that will span empty lines? I.e. if I want to
> test for the word "foo" followed by the word "bar", but the words are separated
> by an empty line, is it possible to do? Nothing I've tried works, although I'm
> a relative novice at this game. Thanks.

This is easy, for example, I wrote the following rule for
my local rules (don't know yet whether it will be
useful though):

full EM_BROKEN_HTML /<meta.*<html>/is
describe EM_BROKEN_HTML META is the first tag even before HTML

man perlre or perldoc perlre will help you understand
what 's' and other flags mean in Perl regular
expressions.
Eugene

--
Email: <jmv at online.ru>

Re: Can tests span empty lines? [ In reply to ]

Feb 24, 2004, 2:56 PM

Post #6 of 9 (945 views)

On Tue, Feb 24, 2004 at 09:04:50PM +0000, Mark London wrote:
...
> That would match foo or bar anywhere in the message. I want to test for foo
> followed by bar, and no other words in between, but empty lines are ok.

From a discussion about 'unlimited patterns' like 'word1.*word2'
I seem to remember, that spamassassin reads the whole body
as if it is a complete long line. So what you *then* would
need ist just 'foo\s{1,N}bar' (replace the 'N' with the
*number* of spaces/newlines you want to allow, but better
NOT make it 'infinitely long').
This should then trigger on 'foo' followed by whitespace up
to the limit followed by 'bar'.

If it does NOT work (I did not test it yet) you could also
try 'foo[\s\n]{1,N}bar' explicitely allowing the newline.

Hope this helps, Stucki

--
Christoph von Stuckrad * * |nickname |<stucki@math.fu-berlin.de>\
Freie Universitaet Berlin |/_*|'stucki' |Tel(days):+49 30 838-75 459|
Fachbereich Mathematik, EDV|\ *|if online|Tel(else):+49 30 77 39 6600|
Arnimallee 2-6/14195 Berlin* * |on IRCnet|Fax(alle):+49 30 838-75454/

Re: Can tests span empty lines? [ In reply to ]

Feb 24, 2004, 6:29 PM

Post #7 of 9 (947 views)

Chr. von Stuckrad <stucki <at> math.fu-berlin.de> writes:
From a discussion about 'unlimited patterns' like 'word1.*word2'
> I seem to remember, that spamassassin reads the whole body
> as if it is a complete long line. So what you *then* would
> need ist just 'foo\s{1,N}bar' (replace the 'N' with the
> *number* of spaces/newlines you want to allow, but better
> NOT make it 'infinitely long').
> This should then trigger on 'foo' followed by whitespace up
> to the limit followed by 'bar'.

This works, but only if I use the "full" rather than "body"
command, as recommended by Eugene Morozov in another post.
Thanks all! - Mark

Re: Can tests span empty lines? [ In reply to ]

lwilton at earthlink

Feb 25, 2004, 1:44 AM

Post #8 of 9 (952 views)

In theory a body test on that should work. A rawbody test will fail.
Unfortunately, I've discovered that 'body' is not at all what you think it
is, like the text body of the message. Instead it seems to be broken up
somewhat arbitrarily, but seemingly along the line of one 'body'
more-or-less per paragraph in an html body.

I have no idea why 'body' doesn't produce the entire text body in a single
string. I suppose there must be a reason for it. It certainly makes it
difficult to write useful rules that depend on N occurances of something in
the body of the message, when the body will be presented as 5 or 6 different
disjoint pieces to the rule.

Loren

----- Original Message -----
From: "Mark London" <mrl@psfc.mit.edu>
To: <spamassassin-users@incubator.apache.org>
Sent: Tuesday, February 24, 2004 12:33 PM
Subject: Can tests span empty lines?

> Is it possible to create a test that will span empty lines? I.e. if I
want to
> test for the word "foo" followed by the word "bar", but the words are
separated
> by an empty line, is it possible to do? Nothing I've tried works,
although I'm
> a relative novice at this game. Thanks.
>
>

Re: [spa] Re: Can tests span empty lines? (split font color) [ In reply to ]

cgregory at hwcn

Feb 25, 2004, 10:57 AM

Post #9 of 9 (946 views)

Following on my wake-up call to use 'full' tests, here is the revised
rule for 'split' font color specifications:

full LOC_HTMLSPLITFONT /<font color=\n{1,3}"?\#[a-z0-9]{6}\"?>/i
describe LOC_HTMLSPLITFONT font color on separate line from font tag
score LOC_HTMLSPLITFONT 0.7

Dont' miss the escape \ on the "#".... :-)
We can probably raise the score a bit more now that we have a better test.

- Charles