Hallo!
A properly formed e-mail has a single blank line between the body and
the header. So let's checl for that. Because some people send a message
that only contains a subject (which is the 'message' conveyed) we meta
check for both a missing subject *and* body. This pairs up nicely with the
check for no subject and 'undisclosed recipients':
header __UNDISCLOSED To =~ /undisclosed.recipients/i
header __NOSUBJECT Subject !~ /\w/i [if-unset: %]
full __BODYNOTBLANK /\w\n\n\w/i
meta LOC_UNDISCLNOSUBJ (__UNDISCLOSED && __NOSUBJECT)
describe LOC_UNDISCLNOSUBJ To undisclosed recipients with no subject
score LOC_UNDISCLNOSUBJ 1.5
meta LOC_NOSUBJNOBODY (__NOSUBJECT && (! __BODYNOTBLANK) )
describe LOC_NOSUBJNOBODY No Subject and no body text
score LOC_NOSUBJNOBODY 1.5
The __BODYNOTBLANK test actually looks for blank line between headers and
body. And because it is a 'full' test, it should not FP on attachment-only
mail.
- Charles
A properly formed e-mail has a single blank line between the body and
the header. So let's checl for that. Because some people send a message
that only contains a subject (which is the 'message' conveyed) we meta
check for both a missing subject *and* body. This pairs up nicely with the
check for no subject and 'undisclosed recipients':
header __UNDISCLOSED To =~ /undisclosed.recipients/i
header __NOSUBJECT Subject !~ /\w/i [if-unset: %]
full __BODYNOTBLANK /\w\n\n\w/i
meta LOC_UNDISCLNOSUBJ (__UNDISCLOSED && __NOSUBJECT)
describe LOC_UNDISCLNOSUBJ To undisclosed recipients with no subject
score LOC_UNDISCLNOSUBJ 1.5
meta LOC_NOSUBJNOBODY (__NOSUBJECT && (! __BODYNOTBLANK) )
describe LOC_NOSUBJNOBODY No Subject and no body text
score LOC_NOSUBJNOBODY 1.5
The __BODYNOTBLANK test actually looks for blank line between headers and
body. And because it is a 'full' test, it should not FP on attachment-only
mail.
- Charles