David Robert's -castlebbs- Blog

How to use the search

I keep since a few years emails from security mailing-lists. Theses emails are stored in a single folder which can be search using this form :

Search duration can be long, it often exeed 60 seconds. Sorry for the times, I'll have to set up an indexed folder.

The search is done on the body of the message and not the subject or other message header. The query language is strict but intuitive. Here some examples in way of explanation :

• "php 4" and ( exploit or advisory ) and not phpbb
• "sql injection" and union and not magic_quotes_gpc
• "from remote" and critical and hp-ux
• ( "php 4" or php-4) and not phpbb

implicit "and" :

• rhsa apache

Some explanations

I wrote a small program in python that can query my advisories email folder. I wished to be able to have a advanced query language, independent from the IMAP4 language. This abstraction is also made to avoid the risks of IMAP commands injections and also to be able to query other subsystems than IMAP.

As I've set up the form on my website for my own use, I let other people benefit from it (even if their number is negligible: -)

More details

My program uses a lex and yacc python implementation : ply. the grammatical analyzer transforms my query into an Abstract Syntax Tree (AST). This tree is then transformed into an IMAP4 query string.

The grammar I have defined for the query language :

expression : expression AND term

| expression OR term

| term

term  : NOT term

| QWORDS

| WORD

| LPAREN expression RPAREN

For more details, look at the source code.