0

I wrote a regex rule for spamassassin, which should match some words or phrases in both Subject and Body of emails.

The rule is the following:

header __SUBJECT_CHUJ Subject =~ /(powi.ksz.(0,5} penis.|jak powi.kszy.|wcieraj|wmasuj|grubszy|d.u.szy|erekcj.|zwi.sz. rozmiar|b.dzie twardy|b.dzie du.y|b.dzie d.ugi|wzw.d|centymetry)/i
body __BODY_CHUJOWE /\s+(jak powi.kszy.|wcieraj|posmaruj|wmasuj|natrzyj|grubszy|d.u.szy|erekcj.|zwi.sz. rozmiar|b.dzie twardy|wypisz|cz.onek|wypysuj|urosn..|du.ego penisa|b.dzie du.y|b.dzie d.ugi|wzw.d|centymetry|nowy .el|dodatkowe centymetry|dodatkowych centrumetr.w|zadowala. kobiety|)\s+/i
meta CHUJOWY_MAIL (__SUBJECT_CHUJ || __BODY_CHUJOWE )
score CHUJOWY_MAIL 1.4
describe CHUJOWY_MAIL Spam związany z CHUJEM

And it matches 1 words emails such as the following:

Return-Path: <test@example.com>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on mail01
X-Spam-Level: **
X-Spam-Status: No, score=2.8 required=5.0 tests=ALL_TRUSTED,CHUJOWY_MAIL,
    DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_REPLYTO,URIBL_BLOCKED
    autolearn=no autolearn_force=no version=3.4.0
Delivered-To: test@example.com
Received: from example.com (unknown [80.*.*.*.])
    (Authenticated sender: test@example.com)
    by mail.glmr.in (Postfix) with ESMTPSA id 47E44428
    for <test@example.com>; Tue,  2 Oct 2018 22:27:36 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=example.com;
    s=default; t=1538512056;
    bh=Rbj/g/DG4Vxz5Q2spNg8e4CJNwTKexCgSS9rpHGC0c8=;
    h=Date:To:From:Reply-To:Subject;
    b=InLP2mWzq3cWk6N8pNfDxle6swdrp7KaXkQTyHfMJqmZcuRhoJFESQL16RMsyz2LJ
     dFLkXa0TO638JP+MC02DKi79dNGjKOncJSiWCN5z5mVGqg7YzzyPokgtBKNmr/bCG+
     exxcSU3vngAOEVTAqJxQYTiOIXkonJf9R0UAsw9E=
Date: Tue, 2 Oct 2018 20:27:35 +0000
To: test@example.com
From: test name <test@example.com>
Reply-To: myprivatemail@gmail.com
Subject: test subject
Message-ID: <4596a2f34f0540bf1faeed20f243e652@example.com>
X-Mailer: WPMailSMTP/Mailer/smtp 1.3.3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-EsetId: 37303A29DFC057626C7761

In the body of that email there is only test text Can anyone spot what's wrong in that code? All the other rules I wrote seem to be good.

1

You have typo in first regex, you should use {0,5} instead of (0,5}.

You may want to remove last | in second regex. A (one|two|three|) regex matches empty string (as the 4th alternative inside parentheses is an empty string). So your long regex also matches just /s+/s+ - two subsequent spaces, carriage returns, etc. I think it was not intended.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.