procmail
[Top] [All Lists]

scoring oddity

2000-10-09 13:24:20
I got a few spams last month that had exclamation marks and dollar signs
in odd places in the headers.  I decided to use scoring to look for
two or more of these.  If there, then go on to do a certain body
grep that I won't get into here.

The Message-ID: header, though, often can have legit `$' chars in it.
I wanted to exclude that header.  The following may or may not be
a bit sloppy (improvements solicited!); but it's what I came up with:

     :0 i  # two+ `!' or `$' symbols in headers . . .
     * ! ^(Return-Path|Sender):.*list
     * -175^0
     *  100^1 [$!]
     * -100^1 ^Message-ID:.*[$!]
     { do some other things if we're here }

So, I had a piece of mail come in that had two `$' chars in the
Message-ID: header.  There were no other `!' or `$' signs in the
headers.  The logs, though, showed a total score for this section
of -75, not -175!  I don't understand how that could be.
Here is that section of the log (verbose format):

  procmail: Match on ! "^(Return-Path|Sender):.*list"
  procmail: Score:    -175    -175 ""
  procmail: Score:     200      25 "[$!]"
  procmail: Score:    -100     -75 "^Message-ID:.*[$!]"

-- 
Netcom has imploded.  Please now use NOTnetcom.com for mail.
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Ex-Netcommies:  Mail "forwards" for free forwarding service!
NOT affiliated with EarthLink, Inc.'s Netcom brand identity.

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>