Spamassassin regex - is matching almost everything

Question

I wrote a regex rule for spamassassin, which should match some words or phrases in both Subject and Body of emails.

The rule is the following:

header __SUBJECT_CHUJ Subject =~ /(powi.ksz.(0,5} penis.|jak powi.kszy.|wcieraj|wmasuj|grubszy|d.u.szy|erekcj.|zwi.sz. rozmiar|b.dzie twardy|b.dzie du.y|b.dzie d.ugi|wzw.d|centymetry)/i
body __BODY_CHUJOWE /\s+(jak powi.kszy.|wcieraj|posmaruj|wmasuj|natrzyj|grubszy|d.u.szy|erekcj.|zwi.sz. rozmiar|b.dzie twardy|wypisz|cz.onek|wypysuj|urosn..|du.ego penisa|b.dzie du.y|b.dzie d.ugi|wzw.d|centymetry|nowy .el|dodatkowe centymetry|dodatkowych centrumetr.w|zadowala. kobiety|)\s+/i
meta CHUJOWY_MAIL (__SUBJECT_CHUJ || __BODY_CHUJOWE )
score CHUJOWY_MAIL 1.4
describe CHUJOWY_MAIL Spam związany z CHUJEM

And it matches 1 words emails such as the following:

Return-Path: <test@example.com>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on mail01
X-Spam-Level: **
X-Spam-Status: No, score=2.8 required=5.0 tests=ALL_TRUSTED,CHUJOWY_MAIL,
    DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_REPLYTO,URIBL_BLOCKED
    autolearn=no autolearn_force=no version=3.4.0
Delivered-To: test@example.com
Received: from example.com (unknown [80.*.*.*.])
    (Authenticated sender: test@example.com)
    by mail.glmr.in (Postfix) with ESMTPSA id 47E44428
    for <test@example.com>; Tue,  2 Oct 2018 22:27:36 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=example.com;
    s=default; t=1538512056;
    bh=Rbj/g/DG4Vxz5Q2spNg8e4CJNwTKexCgSS9rpHGC0c8=;
    h=Date:To:From:Reply-To:Subject;
    b=InLP2mWzq3cWk6N8pNfDxle6swdrp7KaXkQTyHfMJqmZcuRhoJFESQL16RMsyz2LJ
     dFLkXa0TO638JP+MC02DKi79dNGjKOncJSiWCN5z5mVGqg7YzzyPokgtBKNmr/bCG+
     exxcSU3vngAOEVTAqJxQYTiOIXkonJf9R0UAsw9E=
Date: Tue, 2 Oct 2018 20:27:35 +0000
To: test@example.com
From: test name <test@example.com>
Reply-To: myprivatemail@gmail.com
Subject: test subject
Message-ID: <4596a2f34f0540bf1faeed20f243e652@example.com>
X-Mailer: WPMailSMTP/Mailer/smtp 1.3.3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-EsetId: 37303A29DFC057626C7761

In the body of that email there is only test text Can anyone spot what's wrong in that code? All the other rules I wrote seem to be good.

Answer 1

You have typo in first regex, you should use {0,5} instead of (0,5}.

You may want to remove last | in second regex. A (one|two|three|) regex matches empty string (as the 4th alternative inside parentheses is an empty string). So your long regex also matches just /s+/s+ - two subsequent spaces, carriage returns, etc. I think it was not intended.