Spam dodged my fancy split!

Spam dodged my fancy split!

[Jack Twilley]

Some spam got past my filter, which was specifically designed to
filter out this kind of spam, and in fact was cribbed from the docs.

Here's the relevant snippet of my .gnus file.

--begin .gnus snippet--
 nnmail-split-fancy
 '(| ("gnus-warning" "duplication of messages" "duplicate")
     (to "jmt+usenet@nycap.rr.com"
	 (| ("subject" "re:.*" "misc")
	    ("references" ".*@.*" "misc")
	    "spam"))
     ("from" mail (| ("subject" "warn.*" "mail.warning")
		     "misc"))
     "misc")
 nnmail-split-methods 'nnmail-split-fancy
--end .gnus snippet--

Here's the headers of the evil message.

--begin spam headers--
From: Pandit Paul Kaloti <yourstars@cheerful.com>
Subject:                                                    ARE YOU HAPPY 
To: <jmt+usenet@nycap.rr.com>
Date: Mon, 1 Jun 1998 03:42:07 -0400 (EDT)
X-From-Line: yourstars@cheerful.com  Mon Jun 1 03:42:07 1998
Received: from STAR1 (spc-isp-van-uas-05-4.sprint.ca [209.103.0.205])  by mail-atm.nycap.rr.com (8.8.7/8.8.8) with SMTP id DAA14174  for <jmt+usenet@nycap.rr.com>; Mon, 1 Jun 1998 03:42:07 -0400 (EDT)
Message-Id: <419.435947.02835266 yourstars@cheerful.com>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"
X-UIDL: d4b38dcaeac10379057851daef333041
Lines: 67
Xref: dt01q0n13.nycap.rr.com misc:89
--end spam headers--

Since the message was sent to "jmt+usenet@nycap.rr.com", the "Subject"
field doesn't match the regexp, and the "References" field doesn't
exist, I'd expect this to be sent to "spam".  Why wasn't it?

Jack.
.

Re: Spam dodged my fancy split!

[Aaron M. Ucko]

+ is special in regexps ("x+" means "one or more x s."); change
"jmt+usenet@nycap.rr.com" to "jmt\\+usenet@nycap.rr.com" (or even to
"jmt\\+usenet@nycap\\.rr\\.com" to avoid [unlikely] false positives.)

Re: Spam dodged my fancy split!

[Harald Meland]

[Jack Twilley]

> Some spam got past my filter, which was specifically designed to
> filter out this kind of spam, and in fact was cribbed from the docs.
> 
> Here's the relevant snippet of my .gnus file.
> 
> --begin .gnus snippet--
>  nnmail-split-fancy
>  '(| ("gnus-warning" "duplication of messages" "duplicate")
>      (to "jmt+usenet@nycap.rr.com"

You probably want the above line to read something like

  (to "jmt\\+usenet@nycap\\.rr\\.com"

as the second field in the split is a regexp.  Your regexp would match
"jmtttttttusenet@nycap.rr.com", "jmtusenet@nycap.rr.com" and
"jmtttusenet@nycapxrrycom", but not "jmt+usenet@nycap.rr.com".

-- 
Harald