Re: Some issues with find_all_urls() function

Thanks, I think that’s just what I was looking for with the regex variables. Does that mean I need to add ‘i’ after each of the concatenated patterns for it to be case insensitive?



e.g.



q = /[\‘\’\'\"\s]*(?:&quot|')*/i

q* & /test/i & q & /test2/i & q & /test3/i



The string_to_pattern function will be very handy too ??



Regarding my last message, I realised I can also use find_all instead of match_pattern to find all occurances so that’s awesome.



Thanks,

Jonah



From: Jon Siwek<mailto:[email protected]>
Sent: 14 August 2019 20:25
To: Jonah Burgess<mailto:[email protected]>
Subject: Re: [Zeek] Some issues with find_all_urls() function



On Tue, Aug 13, 2019 at 5:25 PM Jonah Burgess <[email protected]> wrote:
>
> Regarding question 4 I think the concatenation would still take my literal string so I couldn’t store it in a variable e.g. I’d have to do:
>
> /[\‘\’\'\"\s]*(?:&quot|&#039;)*/ & /test/ & /[\‘\’\'\"\s]*(?:&quot|&#039;)*/ & /test2/ & /[\‘\’\'\"\s]*(?:&quot|&#039;)*/
>
> Instead of:
>
> q = r"[\‘\’\'\"\s]*(?:&quot|&#039;)*"
>
> /q*/ & /test/ & /q*/ & /test2/ & /q*/

You can't use the variable directly inside the regex within the '/'
delimiters, but you can just use the variable itself to do simple
concatenations:

    local q = /something/;
    local r = q & /another thing/;

It's true that it's not as flexible as being able to expand the
variable within the regex itself, but still may help for cases where
you just repeat the same pattern text multiple times.

> Currently I am using match_pattern() to extract different blocks of text and then at the end, I want to search the remaining text. Any idea how I can do this efficiently (without having to re-search the already extracted and searched blocks)?

Maybe see something like this to iterate over an input string and then
just modify that input string to chop off everything
up-to-and-including the first match:

    local input_string = "foobar and foo bar and foo ...";

    while ( T )
        {
        print fmt("matching input string: '%s'", input_string);
        local res = match_pattern(input_string, /foo/);

        if ( ! res$matched )
            break;

        print fmt("match at offset %d: '%s'", res$off, res$str);
        input_string = input_string[(res$off - 1 + |res$str|):];
        }

    print fmt("remaining: '%s'", input_string);

> This kind of relates to my last issue; if I were able to convert a string to pattern, then I would just call the sub() function on the original block of text (subbing out each of the pattern matches I retrieved from the earlier blocks of text). Can you convert a string to a pattern?

There's the `string_to_pattern` function:

    https://docs.zeek.org/en/stable/scripts/base/bif/bro.bif.bro.html#id-string_to_pattern

(Ignore the note there that it must be called at startup time, that
documentation is outdated).

I'd probably use the other iteration code I gave above, though rather
than create patterns like this.

- Jon

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek