Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • Pattern /clause/ would result in 5 rule hits.
  • Pattern /^./ would result in 3 rule hits.

When using rules with extended characters / diacritics, you should always use both ISO-8859-1 / UTF-8 encodings.
Body content can be different depending on normalize_charset setting. If matching "fügen", see these examples:

  • body FOO /fügen/    (BAD)
    • Does not work when normalize_charset 1 and mail is converted from ISO-8859-1 to UTF-8
  • body FOO /fÃŒgen/   (BAD)
    • Does not work when normalize_charset 0 and mail is ISO-8859-1
  • body FOO /f(?:\xfc|\xc3\xbc)gen/
    • Works for both encodings, and file is also now very portable and not encoding dependent
    • You can use UTF-8 / ascii table tools found with google, or try perl for hex convert:
      • perl -MEncode -e 'print unpack("H*",encode("UTF-8","ü"))."\n"'
      • perl -e 'print unpack("H*","ü")."\n"'
  • You can also try some replace_tags found in default ruleset, that match different variations:
    • body FOO /f<U>gen/
    • replace_tags FOO

Rawbody rules: rawbody RULENAME /foo/

...