[Mailman-Users] Reply filter

[Richard Damon]

On 9/27/11 5:33 PM, Mark Sapiro wrote:
> Richard Damon wrote:
>> The question is, can a spam filter be set up to check both the From
>> fields and the To/CC fields?
>
> Yes, but it's awkward at best. header_filter_rules are Python regular
> expressions that are matched against the entire set of message headers
> in MULTILINE and IGNORECASE mode. The awkwardness comes about because
> you don't know if the From: precedes or follows the To: or Cc: so you
> need to check both possibilities. A regexp like
>
> ^From:.*user1 at example\.com[^\177]*^(To:|Cc:).*user2 at example\.net'
>
> will match a From: header containing user1 at example.com followed by a
> To: or Cc: header containing user2 at example.net.
>
> Note the use of [^\177]* to skip all the intervening headers between
> From: and To: or Cc:. [^\177] will match anything that isn't a rubout
> (octal 177, hex 7F) including newlines. There should be no rubouts in
> email message headers. You can't use .* here because . won't match a
> newline, and you can't use (?s) to set 'dot matches all' because that
> would allow .*user1 at example\.com to match beyond the From: header.
>
> Then you could add a second regexp to the rule
>
> ^(To:|Cc:).*user1 at example\.com[^\177]*^From:.*user2 at example\.net'
>
> to cover the case where the To: or Cc: precedes From: and then add two
> more with the roles of user1 and user2 reversed.
>
> You might get away with combining all this into one as
>
> ^(From:|To:|Cc:).*(user1 at example\.com|user2 at example\.net)[^\177]*^(From:|To:|Cc:).*(user1 at example\.com|user2 at example\.net)'
>
> (all on one line). This would match any From:, To: or Cc: containing
> either user1 at example.com followed by a From:, To: or Cc: containing
> user2 at example.net. The drawback of this all in one is it would match a
> message From: a 3rd party To: one of the users with Cc: to the other
> and would match a message from one of the users with a Cc: to herself.
>
Thank you, the [^\177]* should be the trick to get the filter to scan 
over multiple lines. Will have to think about handling the unknown order 
of the tag. I don't think it is a problem catching messages they sent cc 
to themselves, and a message to both of them could be worth looking at 
too, likely A (not one of them) posted something, B (one of them) 
replied to A and list, C (another of them) replies back to A, B and the 
list a scathing reply that is rejected, but A (being CC by C) replies 
back to B, C and the list, quoting that material.