[Rspamd-Users] Custom subject.map ignoring certain regexp

[Richard Klingler]

Well don't have much more information than what is in the email message...

When I save the email message from thunderbird and open up in a hex 
editor I also see no special characters...or maybe thunderbrid corrects 
headers?

Is there a way to run this message through rspamd again?

Also wondering if there is a way to find out which line causes a false 
negative.



cheers

richard


Am 02.02.25 um 11:51 schrieb G.W. Haywood:
> Hi there,
>
> On Sun, 2 Feb 2025, Richard Klingler via Users wrote:
>
>> Good morning
>
> And the same to you! :)
>
>> I have a custom subject map setup which seems to work fine...but only 
>> in rare case a spam passes through although it should have matched it.
>>
>> I the subject.map I have this line:
>>
>>
>> /^.*SPENDE.*$/
>>
>>
>> So it should match then this subject in the spam:
>>
>> Subject: SPENDE
>>
>>
>> Can someone explain why the spam slips through?
>
> Without more information it's difficult to say, but my first guess
> would be that the subject header doesn't contain exactly what you
> think it contains.  It's possible that the spammers sometimes use
> characters which are not really the characters that they appear to be
> to you.  Does this particuar regex sometimes match and sometimes not
> match?  If that's the case then I'd be more confident of my guess.
>
> I'd suggest that you try the '/u' flag (meaning perform a UTF-8 match)
> to see if that helps.  See the section of
>
> https://rspamd.com/doc/modules/regexp.html#regular-expressions
>
> (the part beginning with "Each regexp also supports ...").
>
> The UTF-8 matching won't perform miracles, you might need to look more
> carefully at the raw data in the subject lines.  I use quite a lof of
> filters which match the raw data in UTF-8 encoded headers. Example:
>
> /Subject: =\?UTF-8\?B\?.{0,99}8J\+Sp[Q-Za-f].{1,99}\?=/
>
> If my guess is wrong then we'd need some of the missing information.
>