prelude-correlator/master: Fix multiple IDMEF.match() issues

[email protected] Wed, 17 Jun 2009 18:37:07 +0200 (CEST)
Newsgroups gmane.comp.security.ids.prelude.cvs
Message-ID <[email protected]>
commit c8c59ce8f3d3d459b8472233a489be4bff4ffa79
Author: Yoann Vandoorselaere <[email protected]>
Date:   Wed Jun 17 16:45:00 2009 +0200

    Fix multiple IDMEF.match() issues
    
    Locate a regex match anywhere in the input string.
    Handle case where we match the input string but there is no captured
    substring by returning True in place of an empty tuple.
    
    Thanks to Pierre Chifflier <[email protected]> for pointing this out.


========================================

 PreludeCorrelator/idmef.py |    9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)

========================================

diff --git a/PreludeCorrelator/idmef.py b/PreludeCorrelator/idmef.py
index 2bce617..8893570 100644
--- a/PreludeCorrelator/idmef.py
+++ b/PreludeCorrelator/idmef.py
@@ -75,7 +75,7 @@ class IDMEF(PreludeEasy.IDMEF):
                 if not isinstance(needle, _RegexType):
                         ret = value == needle
                 else:
-                        m = needle.match(value or "")
+                        m = needle.search(value or "")
                         if not m:
                                 return False
 
@@ -92,7 +92,7 @@ class IDMEF(PreludeEasy.IDMEF):
                 i = 0
                 while i < len(args):
                         r = self._match(args[i], args[i + 1])
-                        if not r:
+                        if r is False:
                                 return None
 
                         elif isinstance(r, tuple):
@@ -100,7 +100,10 @@ class IDMEF(PreludeEasy.IDMEF):
 
                         i += 2
 
-                return ret
+                if ret:
+                        return ret
+
+                return True
 
         def reset(self):
                 return
_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog