This is a discussion on Help with a multi-line mode rule - SpamAssassin ; Hi all, I hope someone can help me with a rule I'm trying to write. My understanding of the multi-line mode, with the /m switch at the end, is this: in this mode, the caret (^) and dollar ($) match ...
I hope someone can help me with a rule I'm trying to write. My understanding of the multi-line mode, with the /m switch at the end,
is this: in this mode, the caret (^) and dollar ($) match before and after newlines in the string. Is that correct?
I believe this is the correct method for allowing me to use a "full" rule (ie. searching the entire undecoded message) but also
specifying carets and dollars within the regex, right?
So I think this should mean that I can have some text like this, for example:
Subject: this is a test
....and create a rule like the following which should hit on it:
full MYRULE /^Subject:.* test$(?:\s(?!X-Return-Path).*)+\sX-Return-Path: blah\@example\.com/m
Right? If I test this rule using the Regex Coach tool at http://weitz.de/regex-coach/ (I'm on Windows), with the 'm' switch enabled,
the rule works fine. But when I test it with SpamAssassin, it doesn't work and I believe it's due to the carat and dollar.
However I want to specifically specify that the word "test" must be at the very end of the Subject line - hence, I want to have the
$ after it. I also want to specify that the X-Return-Path must be there, which is why I have the rest of the rule the way it is, but
that's not the issue.
What am I doing wrong?
(Of course in reality I'm not searching for the above strings, I'm trying to catch a particular spam sign, but this is a simple
example of the method I'm using)