Spam Filter ISP Forums : Keyword may have not been scanned https://www.logsat.com/spamfilter/forums/ Mon, 09 Mar 2026 02:48:59 +0000 Mon, 12 Mar 2007 10:46:11 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=5978 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Keyword may have not been scanned : ...Nice detective work. Thanks...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9856&title=keyword-may-have-not-been-scanned#9856 Author: sgeorge
Subject: 5978
Posted: 12 March 2007 at 10:46am

...Nice detective work.  Thanks you two!

Stephen
]]> Mon, 12 Mar 2007 10:46:11 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9856&title=keyword-may-have-not-been-scanned#9856 <![CDATA[Keyword may have not been scanned : Hi Robertoturning off &#034;greedy&#034;...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9853&title=keyword-may-have-not-been-scanned#9853 Author: mikek
Subject: 5978
Posted: 12 March 2007 at 6:52am

Hi Roberto

turning off "greedy" mode worked!

personally, i would not change the default behaviour, but maybe update the documentation to state that greedy mode is on by default (as it is with most regex implementations) and mention the -g parameter.

it would also be nice if an exception caused by a regex would be logged...

Cheers,

Mike
]]> Mon, 12 Mar 2007 06:52:22 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9853&title=keyword-may-have-not-been-scanned#9853 <![CDATA[Keyword may have not been scanned : Everyone,It seems that some of...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9847&title=keyword-may-have-not-been-scanned#9847 Author: LogSat
Subject: 5978
Posted: 09 March 2007 at 11:34pm

Everyone,

It seems that some of your RegEx are causing a stack overflow for their complexity, and while SpamFilter will recover from the error, this will cause it to miss the keyword match in that particular string.

We're currently looking at the "greedy" option in RegEx, that is enabled by default in SpamFilter. In the sample mikek provided, we modified his RegEx to include the modifier:
(?-g) at the beginning of the expression. This disables the "greedy" mode in RegEx and successfully detects the string.

Mike, if you change your string from:

((?i)(src="cid:(.)*\$(.)*@(.)*"))

to

((?-gi)(src="cid:(.)*\$(.)*@(.)*"))
or
((?-g)(?i)(src="cid:(.)*\$(.)*@(.)*"))

your expression will work.

Unfortunately this means you may have to add the (?-g) modifier in all your RegEx. We're looking into what side-effects we'd have if we were to disable greedy mode by default in SpamFilter...
]]> Fri, 09 Mar 2007 23:34:22 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9847&title=keyword-may-have-not-been-scanned#9847 <![CDATA[Keyword may have not been scanned : Just did some more tests...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9836&title=keyword-may-have-not-been-scanned#9836 Author: mikek
Subject: 5978
Posted: 08 March 2007 at 11:06am

Just did some more tests and it looks like it has something to do with the regex that is used...

For me, the error shows with this regex: src="cid:(.)*\$(.)*@(.)*"

E-Mail is on it's way...



Edited by mikek]]> Thu, 08 Mar 2007 11:06:01 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9836&title=keyword-may-have-not-been-scanned#9836 <![CDATA[Keyword may have not been scanned : Mike,Can you please froward us...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9835&title=keyword-may-have-not-been-scanned#9835 Author: LogSat
Subject: 5978
Posted: 08 March 2007 at 11:05am

Mike,

Can you please froward us the whole email (headers and email body included)?
]]> Thu, 08 Mar 2007 11:05:42 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9835&title=keyword-may-have-not-been-scanned#9835 <![CDATA[Keyword may have not been scanned : I can confirm this, I was always...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9834&title=keyword-may-have-not-been-scanned#9834 Author: mikek
Subject: 5978
Posted: 08 March 2007 at 10:54am

I can confirm this, I was always wondering why so many spams with inline images came through, although I had the correct "src=cid:..." keywords set.

Just tested my keyword with a mail that came through. If I paste the whole email, the regex test outputs "not found". If I just paste a few lines around the src=cid, it will output "found", like it should...

This is a serious issue that has to be looked into!

Cheers,

Mike
]]> Thu, 08 Mar 2007 10:54:54 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9834&title=keyword-may-have-not-been-scanned#9834 <![CDATA[Keyword may have not been scanned : Hey, thanks for testing it man. Edited...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9801&title=keyword-may-have-not-been-scanned#9801 Author: sgeorge
Subject: 5978
Posted: 26 February 2007 at 5:11pm

Hey, thanks for testing it man. 

Edited by sgeorge]]> Mon, 26 Feb 2007 17:11:02 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9801&title=keyword-may-have-not-been-scanned#9801 <![CDATA[Keyword may have not been scanned : I tested this on 650 and can confirm...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9796&title=keyword-may-have-not-been-scanned#9796 Author: ImInAfrica
Subject: 5978
Posted: 25 February 2007 at 4:20pm

I tested this on 650 and can confirm same issue
Looks like over certain number of characters before the regex hit the regex fails.

Amir

]]> Sun, 25 Feb 2007 16:20:54 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9796&title=keyword-may-have-not-been-scanned#9796 <![CDATA[Keyword may have not been scanned : Just a mini-update...I tried doing...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9791&title=keyword-may-have-not-been-scanned#9791 Author: sgeorge
Subject: 5978
Posted: 23 February 2007 at 6:49pm

Just a mini-update...

I tried doing a full uninstall & reinstall of v 3.1.3.615.  Oddly, it did not fix the problem.

Stephen
]]> Fri, 23 Feb 2007 18:49:43 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9791&title=keyword-may-have-not-been-scanned#9791 <![CDATA[Keyword may have not been scanned : Also, I meant to mention something...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9743&title=keyword-may-have-not-been-scanned#9743 Author: sgeorge
Subject: 5978
Posted: 16 February 2007 at 10:04am

Also, I meant to mention something interesting I noticed in my "RegEx Test" tab in SpamFilter.  If I enter the RegEx search string "(?i)\w ?\w ?\w ?\w ?\. ?p ?k" (no quotes),  I found the following...

The pattern was found in this text:
All work and no play makes Jack a dull boy.
All work and no play makes Jack a dull boy.
All work and no play makes Jack a dull boy.  TEST.PK
All work and no play makes Jack a dull boy.
All work and no play makes Jack a dull boy.


But it was not found in this text:
All work and no play makes Jack a dull boy.
All work and no play makes Jack a dull boy.
All work and no play makes Jack a dull boy.
All work and no play makes Jack a dull boy.  TEST.PK
All work and no play makes Jack a dull boy.


Thanks for listenin'. :)

Stephen
]]> Fri, 16 Feb 2007 10:04:56 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5978&PID=9743&title=keyword-may-have-not-been-scanned#9743