[Bro-Dev] [JIRA] (BIT-1042) Caret in regex pattern doesn't match start of line

[Robin Sommer]

Yeah, that looks like a bug. Bro's treatment of "^/$" is a bit, let's
say, complex unfortunately.

Robin

On Thu, Jul 25, 2013 at 11:21 -0500, you wrote:

> 
>     [ https://bro-tracker.atlassian.net/browse/BIT-1042?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13315#comment-13315 ] 
> 
> Brian Little commented on BIT-1042:
> -----------------------------------
> 
> I was using that as an simple example, but it shouldn't match at all.
> 
> The specific problem I have it trying to remove the first . in a domain, using
> 
> print sub(".github.com", /^\./, "");
> #github.com
> 
> This works, however that specific pattern /^\./ also matches this:
> 
> print sub("github.com", /^\./, "");
> #githubcom (note missing .)
> 
> Is "sub" the wrong tool to use for this? It seems to work for other patterns fine, including the $ (end of string), but not for the start of string
>                 
> > Caret in regex pattern doesn't match start of line
> > --------------------------------------------------
> >
> >                 Key: BIT-1042
> >                 URL: https://bro-tracker.atlassian.net/browse/BIT-1042
> >             Project: Bro Issue Tracker
> >          Issue Type: Bug
> >          Components: Bro
> >    Affects Versions: 2.1
> >         Environment: Ubuntu 12.04 and 13.04. Dependencies from apt-get ubuntu repos only.
> >            Reporter: Brian Little
> >            Priority: Normal
> >              Labels: pattern, regex
> >         Attachments: caret.bro
> >
> >
> > print split_all("some string", /^t/);
> > I would expect it to not match ^t, but it matches any t in the string.
> > output:
> > {
> > [1] = some s,
> > [3] = ring,
> > [2] = t
> > }
> > expected:
> > {
> > [1] = some string
> > }
> > tested on bro 2.1 and github master 2.1-824
> 
> --
> This message is automatically generated by JIRA.
> If you think it was sent incorrectly, please contact your JIRA administrators: https://bro-tracker.atlassian.net/secure/ContactAdministrators!default.jspa
> For more information on JIRA, see: http://www.atlassian.com/software/jira
> _______________________________________________
> bro-dev mailing list
> bro-dev at bro.org
> http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
> 


-- 
Robin Sommer * Phone +1 (510) 722-6541 *     robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 * www.icir.org/robin