On Thu, 2 Jun 2005, Nigel Metheringham wrote:
>
> Additionally, Chris Edwards suggested that it be possible to scan the
> first n KB of a message. This raises the following issues:-
> * Is SA on a part message sensible? A partial message could, in
> theory, banjax a load of SA rules, so getting lots of extra hits
> for (say) maleformed MIME
It doesn't seem to cause too much damage - there is a tiny number of SA
rules which check MIME message structure and HTML structure which can
cause truncated messages to gain only a point or so. A plausible way to
fix this would be to add a marker to a truncated message which is spotted
by some SA rules that compensate for the truncation score penalty.
Tony.
--
<fanf@???> <dot@???>
http://dotat.at/ ${sg{\N${sg{\
N\}{([^N]*)(.)(.)(.*)}{\$1\$3\$2\$1\$3\n\$2\$3\$4\$3\n\$3\$2\$4}}\
\N}{([^N]*)(.)(.)(.*)}{\$1\$3\$2\$1\$3\n\$2\$3\$4\$3\n\$3\$2\$4}}
