Bug 7745 - Implement fullbody and fullrawbody or similar ruletypes
Summary: Implement fullbody and fullrawbody or similar ruletypes
Status: NEW
Alias: None
Product: Spamassassin
Classification: Unclassified
Component: Libraries (show other bugs)
Version: SVN Trunk (Latest Devel Version)
Hardware: All All
: P2 enhancement
Target Milestone: 4.0.0
Assignee: SpamAssassin Developer Mailing List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-08-11 12:07 UTC by Henrik Krohns
Modified: 2019-08-11 12:14 UTC (History)
1 user (show)



Attachment Type Modified Status Actions Submitter/CLA Status

Note You need to log in before you can comment on or make changes to this bug.
Description Henrik Krohns 2019-08-11 12:07:53 UTC
(Report from dev list)

https://cwiki.apache.org/confluence/display/SPAMASSASSIN/WritingRulesAdvanced

The concept of body paragraphs is somewhat troubling, since DEAR_EMAIL will
not match this for example:

body  DEAR_EMAIL /^\s*Dear\b.{0,70}\w\@\w/i

-------------------
Dear foo,

Spam me at foo@bar
-------------------

Only solution for that would be making separate subrules to match both Dear
and email etc, but it can't see how "near" the matches are to each other.

So we should really implement some new ruletypes or tflags for 4.0.0, like
fullbody and fullrawbody where the text is not split to chunks in any way.
It's really not a problem to match 50-500k blobs (*_part_size_limit) these
days.  Of course they would be only used when necessary, like "full" rules
already.

They should also do complete matching per mimepart, not across them.
Comment 1 Henrik Krohns 2019-08-11 12:14:31 UTC
Of course we can also evaluate disabling chunking for standard body/rawbody rules completely. We already have (raw)body_part_scan_size options to limit damage from bad regexps.