...
- body FOO /fügen/ (BAD)
- Does not work when normalize_charset 1 and mail is converted from ISO-8859-1 to UTF-8
- body FOO /fÃŒgen/ (BAD)
- Does not work when normalize_charset 0 and mail is ISO-8859-1
- body FOO /f(?:\xfc|\xc3\xbc)gen/
- Works for both encodings, and file is also now very portable and not encoding dependent
- You can use UTF-8 / ascii table tools found with google, or try perl for hex convert:
- perl -MEncode -e 'print unpack("H*",encode("UTF-8","ü"))."\n"'
- perl -e 'print unpack("H*","ü")."\n"'
- You can also try some replace_tags found in default ruleset, that match different variations:
- body FOO /f<U>gen/
- replace_tags FOO
As body is processed in raw bytes, Unicode-regex features like \p{} can not currently be used.
Rawbody rules: rawbody RULENAME /foo/
...
If there are multiple headers named "Header", the matched string contains each of them are individually matchedthe headers, newline separated, starting from first (topmost).
- If Header:raw is used, all whitespace and newlines are preserved. Again multiple headers are concatted in the same matching string.
- When using anchors (/^foo/), use m-modifier if any of the duplicate Headers should match. Without, only the first header (line) will match.