matching multiple lines
Peter Bishop
pgb at adelard.com
Tue Jul 20 13:27:42 CEST 2004
On 20 Jul 2004 at 12:07, Boris 'pi' Piwinger wrote:
> Peter Bishop said:
> > Does anyone know if you can match more
> > than one line of email text with a single procmail "*" command?
>
> AFAIK you can't.
>
> > I need it to cover cases where an email header line
> > is split over several lines, (with tabs on continuation lines)
>
> No need to do it. It is joined automatically.
Apparently it doesn't for attachment info that is not in the main
header.
However have now found the email I was lookingi for
(see below) - it seems to work OK
------- Forwarded message follows -------
To: Fred Yankowski <fred at ontosys.com>
Copies to: bogofilter at aotto.com
Organization: Newt Software
Date sent: Thu, 29 Jan 2004 13:45:48 -0800
From: Bill Wohler <wohler at newt.com>
Subject: Re: dealing with email from "Mydoom" worm
[ Double-click this line for list subscription options ]
Fred Yankowski <fred at ontosys.com> writes:
> # NOTES:
> Content-Type headers inside the document body typically have
> # their 'name' attribute on the following line.
> Since this is not in the > # header of the message,
> procmail does not fold these lines together,
> # and so there is no way to be sure that we are matching the name
> # attribute that is associated with a content-type of
> # application/octet-stream. We get a false-positive match on a
> # message with multiple attachments, one of type
> # application/octet-stream and another with one of the bad names.
> # Oh well.
You could use the $ regexp to match a newline. The following rule
matches whether the name (or filename) parameter is on the same line
as the Content-Type or Content-Disposition header field or not and
doesn't care about the actual content type. Note that that parameter
is "filename" in the Content-Disposition header field.
:0 B:
* ^Content-Transfer-Encoding:.*base64
* ^Content-(Type|Disposition):.*$?.*name
*=.*\.(bat|cmd|exe|pif|scr|zip)
spam/exe/.
--
Bill Wohler <wohler at newt.com> http://www.newt.com/wohler/ GnuPG
ID:610BD9AD
Maintainer of comp.mail.mh FAQ and MH-E. Vote Libertarian!
If you're passed on the right, you're in the wrong lane.
---------------------------------------------------------------------
FAQ: http://bogofilter.sourceforge.net/bogofilter-faq.html
To unsubscribe, e-mail: bogofilter-unsubscribe at aotto.com
For summary digest subscription: bogofilter-digest-
subscribe at aotto.com
For more commands, e-mail: bogofilter-help at aotto.com
------- End of forwarded message -------
--
Peter Bishop
pgb at adelard.com
pgb at csr.city.ac.uk
More information about the Bogofilter
mailing list