[Rspamd-Users] Custom subject.map ignoring certain regexp

[G.W. Haywood]

Hi there,

On Sun, 2 Feb 2025, Richard Klingler via Users wrote:

> Good morning

And the same to you! :)

> I have a custom subject map setup which seems to work fine...but only in rare 
> case a spam passes through although it should have matched it.
>
> I the subject.map I have this line:
>
>
> /^.*SPENDE.*$/
>
>
> So it should match then this subject in the spam:
>
> Subject: SPENDE
>
>
> Can someone explain why the spam slips through?

Without more information it's difficult to say, but my first guess
would be that the subject header doesn't contain exactly what you
think it contains.  It's possible that the spammers sometimes use
characters which are not really the characters that they appear to be
to you.  Does this particuar regex sometimes match and sometimes not
match?  If that's the case then I'd be more confident of my guess.

I'd suggest that you try the '/u' flag (meaning perform a UTF-8 match)
to see if that helps.  See the section of

https://rspamd.com/doc/modules/regexp.html#regular-expressions

(the part beginning with "Each regexp also supports ...").

The UTF-8 matching won't perform miracles, you might need to look more
carefully at the raw data in the subject lines.  I use quite a lof of
filters which match the raw data in UTF-8 encoded headers.  Example:

/Subject: =\?UTF-8\?B\?.{0,99}8J\+Sp[Q-Za-f].{1,99}\?=/

If my guess is wrong then we'd need some of the missing information.

-- 

73,
Ged.