[Bro-Dev] case-insensitive patterns
johanna at icir.org
Fri Jun 29 12:38:25 PDT 2018
On Fri, Jun 29, 2018 at 12:26:34PM -0700, Vern Paxson wrote:
> > Just so I have this right: it looks like the preferred would not be
> > /(?i foo)/ but rather /(?i)foo/, yes?
> Oh and to follow up on this, so in PCRE does /x((?i)bar)foo/ make the "foo"
> part case-insensitive too, or not? It's not obvious to me from the page
> you pointed me at, and I don't have an environment set up to definitively
> test this.
It does not. So:
/x((?i)bar)foo/ is (kind-of ) equivalent to /x(?i:bar)foo/ and only makes the bar
part case insensitive.
/x(?i)barfoo/ would make barfoo case insensitive.
I am fine with implementing either (?[flags]) or (?[flags]:[pattern) or
I hope this makes sense.
: Kind-of, because (?i:bar) is non-capturing, whereas ((?i)bar)
captures "bar" in the first capture-variable. Since we don't support
capturing at the moment that does not really matter for us - it might be
of importance in the future though.
More information about the bro-dev