spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From John Hardin <jhar...@impsec.org>
Subject Re: Email address in subject line
Date Sun, 29 Dec 2013 02:57:53 GMT
On Sat, 28 Dec 2013, Amir 'CG' Caspi wrote:

> On Mon, December 23, 2013 5:39 pm, Amir 'CG' Caspi wrote:
>> I did check... unless I'm completely blind, I don't see it.  I'm basically
>> looking for something like:
>>
>> header  EMAIL_IN_SUBJ  Subject =~
>> /[A-Za-z0-9.-_+]+@(?:[A-Za-z0-9]+\.)+[A-Za-z]{3,5}/
>>
>> i.e. something that will match a valid email address in the subject line.
>> However, I'm specifically wanting to match this to the recipient email
>> address, i.e. not just ANY email address in the subject line, but the same
>> one that's in the From: line.  (This latter, I have no idea how to do,
>> since I don't know if SA can do saved patterns from one line to another,
>> e.g. $1, $2, etc.)
>>
>> Any ideas?
>
> So, um... anyone have ideas on how to implement this, or if it's supposed
> to already be implemented somehow?
>
> Hope everyone had a good holiday (from work, at least), and happy new year
> to all!

http://ruleqa.spamassassin.org/20131228-r1553799-n/__SUBJ_HAS_TO_1/detail?srcpath=jhardin

http://ruleqa.spamassassin.org/20131228-r1553799-n/T_TO_IN_SUBJ/detail?srcpath=jhardin

And in case you actually did mean From: rather than recipient address...

http://ruleqa.spamassassin.org/20131228-r1553799-n/__SUBJ_HAS_FROM_1/detail?srcpath=jhardin

Unfortunately __SUBJ_HAS_TO_1 isn't performing well enough against the 
current masscheck corpora to be published. It's possible that the majority 
of mail has the Subject: header appear before the To: header (which would 
be the __SUBJ_HAS_TO_2 rule I haven't gotten around to writing yet).

It also doesn't work on a "bare" email address in the To: header, the RE 
requires proper angle-bracket form.

If you can post a spample or two somewhere I'll see what I can do.

-- 
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@impsec.org    FALaholic #11174     pgpk -a jhardin@impsec.org
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   The difference between ignorance and stupidity is that the stupid
   desire to remain ignorant.                             -- Jim Bacon
-----------------------------------------------------------------------
  576 days since the first successful private support mission to ISS (SpaceX)

Mime
View raw message