[Bro-Dev] case-insensitive patterns

[Johanna Amann]

On Fri, Jun 29, 2018 at 12:26:34PM -0700, Vern Paxson wrote:
> > Just so I have this right: it looks like the preferred would not be
> > /(?i foo)/ but rather /(?i)foo/, yes?
> 
> Oh and to follow up on this, so in PCRE does /x((?i)bar)foo/ make the "foo"
> part case-insensitive too, or not?  It's not obvious to me from the page
> you pointed me at, and I don't have an environment set up to definitively
> test this.

It does not. So:

/x((?i)bar)foo/ is (kind-of [1]) equivalent to /x(?i:bar)foo/ and only makes the bar
part case insensitive.

/x(?i)barfoo/ would make barfoo case insensitive.

I am fine with implementing either (?[flags]) or (?[flags]:[pattern) or
both.

I hope this makes sense.

Johanna

[1]: Kind-of, because (?i:bar) is non-capturing, whereas ((?i)bar)
captures "bar" in the first capture-variable. Since we don't support
capturing at the moment that does not really matter for us - it might be
of importance in the future though.