Work with String Values

Note that it is required to consider encoding of the search text in all rules and plug-in parameters that use a message header or body.

Values that are specified directly and not in Latin can match only if the search text encoding is the same as the encoding used in the configuration file. If it is required to use values in another encoding, insert a string transformed into the required encoding and coded using a transport code, for example base64. The final string value must be of the following form:

=?<source_enc>?<B|Q>?<coded_text>?=

where:

•<source_enc> – source text encoding (for example, UTF-8, CP1251);

•<B|Q> – indicator of the used transport encoding (B - base64, Q - quoted-printable);

•<coded_text> – encoded string value.

Note that if the result value must be treated as a regular expression, escape regular expression symbols (for example, ? inquiry character) with double backslash '\\'.

Example:

Suppose it is required to search messages that contain the word "тест" entered in the Russian language using the Cyrillic script in CP1251 encoding. After the text is translated into base64 transport encoding, the string is as follows: 8uXx8go=.

To get strings in the required encoding, use special tools, for example, iconv and base64. The following example translates the "тест" character string from UTF-8 encoding to CP1251, and then presents the string with the use of base64:

echo "тест" | iconv -f utf-8 -t cp1251 | base64

Example of usage in plug-ins:

1. To enable Dr.Web Modifier to select a header that includes "тест" in CP1251 encoding, specify the following condition in the modification rule:

select mime.headers Subject "=\\?cp1251\\?B\\?8uXx8go=\\?="

2. To enable Vaderetro to add the word "тест" in CP1251 encoding to message headers, specify the following:

SubjectPrefix = "=?cp1251?B?8uXx8go=?="

3. To enable Dr.Web HeadersFilter to reject messages, containing in subject the word "тест" in CP1251 encoding, specify the following:

RejectCondition = Subject = "=\\?cp1251\\?B\\?8uXx8go=\\?="