At 15:58 2002-05-02 -0400, Pantelis Hadzipantelis did say:
> * ? grep -A1 -i ^Content-Type: | grep -i name | egrep -v -i
> \.\(doc\|xls\)\"?\;?$
Umm that won't work...
That's an elaborate statement. You're free to state WHY you believe this.
Why do you have a " in here > \.\(doc\|xls\)\"?\;?$
Because attachment filenames may be represented in muliple forms:
name = "somefilename.ext";
name=somefilename.ext;
name=somefilename.ext
name="somefilename.ext";
name="somefilename.ext"
name = "somefilename.ext"
(not to mention filename= vs name=, etc).
If you don't have some trailing delimiters on the filenames, then some
virus is going to creep right on through to you because you find your text
as a substring in the whole mess:
name = somefilename.doc.exe
Not without irony, this is how most virus attachments are being sent, so it
seems like a sensible thing to anchor the extension check to the end of the
filename specification. Or did I miss something? No matter, I've invested
quite enough time already. If my input was insufficient to get you
running, then perhaps someone else will take up your torch for you.
Those trailing delimiter checks - quote, semicolon, and EOL, are intended
to catch the actual EXTENSION, not simply the appearance of the text in the
middle of a stream. You'll note that they're optional - but the EOL
isn't. That anchors the match to the RHS, which is the end of the filename
where the extension resides.
As per my disclaimer, no warranty is implied. Perhaps your messages have
other junk in them and the expression needs a tweak (I thought stated
"Tweak as you see fit", which was a reference to tweaking it to your
specific situation, but I must have failed to say that). Only nominal
adjustments should be necessary - perhaps leeching into an OR condition on
the inital header being grepped.
I tried it to test it, did not do anything... (in a sandbox)...
Have you referred to your VERBOSE log to investigate WHY?
[BA snip]
Since you excerpted text for context already, would you mind not sending
the whole message back to the list?
---
Sean B. Straw / Professional Software Engineering
Procmail disclaimer: <http://www.professional.org/procmail/disclaimer.html>
Please DO NOT carbon me on list replies. I'll get my copy from the list.
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail