spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From John Hardin <jhar...@impsec.org>
Subject Re: Multiple regex on same URL
Date Tue, 07 Jul 2020 23:46:27 GMT
On Tue, 7 Jul 2020, Martin Gregorie wrote:

> On Tue, 2020-07-07 at 22:07 +0000, Pedro David Marco wrote:
>> Thanks Martin, but  the meta may be possitive if one URL triggers
>> SUBRULE1 and another different URL triggers SUBRULE2...
>>  how can you be sure both SUBRULES are possitive in the "same" URL?
>>
> I didn't spot the requirement that the URIs must match: I read your
> requirement as being that two matches from a group of URLs within a
> defined set or with the same second level domain would do. My mistake.
>
> Might it be easier to define and implement with a decent RDBMS and a
> clever SQL query?

Ugh, no.

The (?=...)(?!...) is a good way, but if you use * or + you need to be 
careful to avoid the possibility of a backtrack DOS - use the "non-greedy" 
version. However, that weakness is smaller as we're looking at URIs rather 
than the entire message body - there's less to potentially backtrack over.

I suggest the positive match first, then the negative match, as the 
positive match will probably occur in only a small percentage of URIs 
scanned and will thus generally fail and shortcircuit the evaluation of 
the (much more likely to hit) negative lookforward match.

-- 
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@impsec.org    FALaholic #11174     pgpk -a jhardin@impsec.org
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   We have to realize that people who run the government can and do
   change. Our society and laws must assume that bad people -
   criminals even - will run the government, at least part of the
   time.                                               -- John Gilmore
-----------------------------------------------------------------------
  Today: Robert Heinlein's 113th birthday

Mime
View raw message