Please document a working regexp example

[rspamd]

Please document a working regexp example

[jmptbl]

@systemcrash I needed to compile a regexp rule recently, and also struggled to figure out the regexp module. Eventually I got something working. Below is the content of my local.d/regexp.conf file, hope it helps.

"RE_SEXTORTION" = {
	re = '/your/{words} && /password/{words} && /buy/{words} && /bitcoin/{words}';
	score = 15.0;
}

[systemcrash]

What field were you filtering on and what was the typical content? The module isn't the easiest to use, I have to admit...

…

On Wed, 22 Apr 2020 at 15:28, Aragon Gouveia ***@***.***> wrote: @systemcrash <https://github.com/systemcrash> I needed to compile a regexp rule recently, and also struggled to figure out the regexp module. Eventually I got something working. Below is the content of my local.d/regexp.conf file, hope it helps. "RE_SEXTORTION" = { re = '/your/{words} && /password/{words} && /buy/{words} && /bitcoin/{words}'; score = 15.0; } — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#423 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAE6DUJGEHZD3OMBP4AQ2ILRN3WH5ANCNFSM4JKLW37Q> .

[jmptbl]

It filters on the {words} type, which is a transformation on the message body documented as follows:

Unicode normalized (to NFKC) and lowercased words extracted from the text (excluding URLs), subject and From displayed name

The content was sextortion type emails that I was given as examples. They were sneakily encoded with strange UTF-8 character sequences, so {words} and the regexp patterns I gave seemed good enough given the size and type of the user base in question.