On Tue, 17 Jun 2003, Paul Chvostek wrote:
Since the goal is to block spam that contains an empty text/plain part,
a message with an embedded multipart part will almost certainly not be
spam.
I've had spams with multipart/alternative top-parts and multipart/mixed as
one of the alternatives. Not many, but I've had them.
* $ B ?? ^$\MATCH($)Content-
Wouldn't you get the same effect by escaping the $ with a backslash?
Probably, right up until I decided to cut and paste something into a new
condition that doesn't have a "* $" wherein \$ matches a literal dollar
sign. I just prefer to use the unambiguous form.
I see what's missing; switching the * to a + would still match parts
with a non-zero amount of whitespace. I guess you'd need:
* $ B ?? ^--$\MATCH$NL(\
(.+$NL)*\
Content-Type:[$WSPC]+text/plain.*$NL|\
(.+$NL)*\
)?$NL\
([$WSPC]*$NL)*$NL\
^--$\MATCH(--)?$NL
Is that finished now? :)
I'm still not sure exactly what you expect that to match. As written, it
matches any empty body part, not just an empty text/plain part, but it
still doesn't match a malformed body part containing exactly one newline
between the boundaries. I *think* what you're trying to get at is
* $ B ?? ^--$\MATCH$NL(\
(.+$NL)*\
Content-Type:[$WSPC]+text/plain.*$NL\
(.+$NL)*\
)?\
([$WSPC]*$NL)*\
--$\MATCH(--)?$NL
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail