Loading ...
Sorry, an error occurred while loading the content.

276772Re: rejecting long subject strings with pcre header checks

Expand Messages
  • Noel Jones
    Apr 27, 2011
      On 4/27/2011 7:23 AM, Troy Piggins wrote:
      > * Noel Jones wrote :
      >> On 4/27/2011 6:17 AM, Troy Piggins wrote:
      >>> Hi there. I'm noticing lately most of the spam that gets through my
      >>> postgrey/postfix/amavis/spamassassin/procmail rules contains subject
      >>> lines that are extremely long strings with no spaces in them. eg:
      >>>
      >>> Subject: DownloadLaetstMMiicrosoftAndAppleSotftawreAndSaveThouasadnds.ApprvoedLicecnseddS
      >>>
      >>> They do seem to have non-alnum chars such as ?-. etc. Just no
      >>> spaces.
      >>>
      >>> I'm thinking there must be a header check with pcre on Subject that
      >>> could catch these. Been googling but can't find anyone that seems
      >>> to mention this. Might be my poor search term selection?
      >>>
      >>> Any suggestions?
      >>
      >> regexp and pcre compatible expression:
      >>
      >> /^Subject: +[^[:space:]]{60}/ REJECT no spaces
      >
      > Thanks mate. That works beautifully. One minor improvement. I
      > think your quantifier there matches /exactly/ 60 non whitespaces.

      Yes, intentionally. Since the expression doesn't check for
      anything after the {N} non-space characters, it doesn't matter
      what comes after it.


      > I
      > added a comma after it to specify at least instead.

      Unnecessary unless you're looking for additional matches after
      the non-space characters. General rule of thumb is don't
      waste resources trying to match things that don't matter.


      -- Noel Jones
    • Show all 24 messages in this topic