Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.
body LOCAL_SHORT_BODY /^.{2,120}$/
score LOCAL_SHORT_BODY 0.4
describe LOCAL_SHORT_BODY Short body

I included this in my local.cf, and gave it a low score as it's not really a great indicator of spam on its own, but in conjunction with other rules I have, it works well.

The problem is, even long emails seem to trigger this rule. Why? I'm pretty sure my regex above is correct (a body of 2-120 chars).

share|improve this question
    
Aren't you saying match any character (.) two to 120 times? –  NickW Apr 15 '13 at 16:29
    
Yes. I want to match any email that is 2-120 chars in length. Is the above expression considered Perl regex? Do I need the =~ symbol before it? –  CaptSaltyJack Apr 15 '13 at 16:36
    
Though it's not like it's NOT matching text.. it's matching anything/everything. –  CaptSaltyJack Apr 15 '13 at 16:40
    
That's what I'm wondering, it seems at first glance to be correct ^ start . any character {2,120} between 2 and 120 $ end, what I'm wondering is if it could be saying, well, up to 120 characters can be matched in a 2000 character document... –  NickW Apr 15 '13 at 16:42
    
So, if you add =~m/ what happens? –  NickW Apr 15 '13 at 16:44

1 Answer 1

Your rule:

body LOCAL_SHORT_BODY /^.{2,120}$/
score LOCAL_SHORT_BODY 0.4
describe LOCAL_SHORT_BODY Short body

says that any line in the email has 2-120 characters in it. Almost all mail will match this.

Because whitespace is specially treated, I'd also steer you away from the "right" regex solution of /^.{2,120}$/s but instead I would recommend:

ifplugin Mail::SpamAssassin::Plugin::BodyEval
if can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length)
body __LOCAL_BODY_LT_2     eval:check_body_length('2')
body __LOCAL_BODY_LT_120   eval:check_body_length('120')
meta LOCAL_SHORT_BODY      !__LOCAL_BODY_LT_2 && __LOCAL_BODY_LT_120
score LOCAL_SHORT_BODY     0.4
describe LOCAL_SHORT_BODY  Short body
endif
endif

I don't recall when check_body_length() was added, but when it comes to stuff like SpamAssassin, you always want the latest version. The above conditionals ensure that you don't break anything if you're stuck on an older version.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.