This article applies to:

• Trustwave MailMarshal (SEG)
• Trustwave ECM/MailMarshal Exchange 7.X

Question:

• How do I add text to the end of a subject line using Header Rewrite?
• Why are carriage returns unexpectedly added or removed when I rewrite my Subject line?

Causes:

One of the most frequently recommended catch-all regular expressions in SEG or ECM Header Rewrite rules is the following Field Search Expression:

(.+)

The problem with this expression is that it matches against everything in the header field including the carriage return. For example let's say we use (.+) as a search expression, and we Substitute into field using expression:

$1 <My inserted text>

When written this way, the rule gives some unexpected results. A carriage return is inserted between the original text and the inserted text. If you test this in the Test Rule utility in the Header Rewrite Rule Wizard you should see the following results:

Original subject text
 <My inserted text><end>

This rewrite inserts a carriage return in the subject field, causing it to wrap to a second line, and will also cause the header field immediately below the subject field to wrap up to the end of the subject line (as the trailing carriage return is deleted).

Procedure:

To get Header Rewrite to add the text correctly at the end of the subject field, without erroneously inserting or removing carriage returns, we must use a different Field Search Expression. We recommend using a Lookahead expression. In this example we use an expression which matches a string ending with a Carriage Return and Linefeed, but without including or going past the CRLF (this is the regular expression Lookahead ability). Also, in the Substitute Into... we use $0 (the entire original field text) as the basic string that will be appended to.

• Field Search expression:  .+(?=\r\n)
• Substitute into field using expression:   $0 <My inserted text>

This Header Rewrite rule gives the following results when using the Test Rule utility:

Original subject text <My inserted text>
<end>

This is the result required for this rule to work correctly. Notice that no carriage returns are inserted into the subject field, and the field ends with the correct carriage return. To confirm that everything is working as expected, send some messages through which trigger the Header Rewrite rule. Examine the header and confirm that the subject line is altered exactly as required.

Notes:

• Earlier versions of this article recommended use of a negated character set [^\r\n] . However, where the subject line is very long and is "folded" onto a second line, using the negated expression results in the inserted text being added more than once (at the end of each line of the "folded" text). The Lookahead expression works correctly with any length of subject line.
• As a simpler method of altering the subject, that does not require Regular Expressions, in current versions of MailMarshal SMTP/SEG you can use the "prepend text" rule action.

This article was previously published as:

NETIQKB44756