matching multiple lines

[Peter Bishop]

On 20 Jul 2004 at 12:07, Boris 'pi' Piwinger wrote:

> Peter Bishop said:
> > Does anyone know if you can match more
> > than one line of email text with a single procmail "*" command?
> 
> AFAIK you can't.
> 
> > I need it to cover cases where an email header line
> > is split over several lines, (with tabs on continuation lines)
> 
> No need to do it. It is joined automatically.

Apparently it doesn't for attachment info that is not in the main
header.

However have now found the email I was lookingi for
(see below) - it seems to work OK


------- Forwarded message follows -------
To:             	Fred Yankowski <fred at ontosys.com>
Copies to:      	bogofilter at aotto.com
Organization:   	Newt Software
Date sent:      	Thu, 29 Jan 2004 13:45:48 -0800
From:           	Bill Wohler <wohler at newt.com>
Subject:        	Re: dealing with email from "Mydoom" worm

[ Double-click this line for list subscription options ] 

Fred Yankowski <fred at ontosys.com> writes:

> # NOTES:  
> Content-Type headers inside the document body typically have
> # their 'name' attribute on the following line.  
> Since this is not in the > # header of the message, 
> procmail does not fold these lines together,
> # and so there is no way to be sure that we are matching the name
> # attribute that is associated with a content-type of
> # application/octet-stream.  We get a false-positive match on a
> # message with multiple attachments, one of type
> # application/octet-stream and another with one of the bad names.  
> # Oh well.

You could use the $ regexp to match a newline. The following rule
matches whether the name (or filename) parameter is on the same line 
as the Content-Type or Content-Disposition header field or not and 
doesn't care about the actual content type. Note that that parameter 
is "filename" in the Content-Disposition header field.

    :0 B:
    * ^Content-Transfer-Encoding:.*base64
    * ^Content-(Type|Disposition):.*$?.*name 
*=.*\.(bat|cmd|exe|pif|scr|zip)
    spam/exe/.


-- 
Bill Wohler <wohler at newt.com>  http://www.newt.com/wohler/  GnuPG 
ID:610BD9AD
Maintainer of comp.mail.mh FAQ and MH-E. Vote Libertarian!
If you're passed on the right, you're in the wrong lane.

---------------------------------------------------------------------
FAQ: http://bogofilter.sourceforge.net/bogofilter-faq.html
To unsubscribe, e-mail: bogofilter-unsubscribe at aotto.com
For summary digest subscription: bogofilter-digest-
subscribe at aotto.com
For more commands, e-mail: bogofilter-help at aotto.com
------- End of forwarded message -------

-- 
Peter Bishop 
pgb at adelard.com
pgb at csr.city.ac.uk