> > > How would you make this work for docs.google.com as well? > > > > the following regex corresponds to > https://urldefense.proofpoint.com/v2/url?u=https-3A__drive.google.com&d=DwIBAg&c=aqMfXOEvEJQh2iQMCb7Wy8l0sPnURkcqADc2guUW8IM&r=X0jL9y0sL4r4iU_qVtR3lLNo4tOL1ry_m7-psV3GejY&m=rEXlMfZlmblv9Z7-T3igLJxWqr_PGyZY9iAcmjGZlI8&s=WpPUlXqGbkNw_lGZL2cge923JMkot3sLI36an1salO4&e= > > next if > /^MBL_\d+:0:\*:68747470733a2f2f64726976652e676f6f676c652e636f6d$/; > > If I remember correctly (I am at home and I have nothing to check), the > URL is encoded in base64 so it should be: > 68747470733a2f2f646f637s2e676f6f676c652e636f6d > > But you better double check :)
>From your comments in the script: > the following regex corresponds to https://drive.google.com When I use an online base64 converter that ends up being aHR0cHM6Ly9kcml2ZS5nb29nbGUuY29t But what I'm asking for is to also include an "OR" to catch https://docs.google.com (note the 'docs', not 'drive')
_______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
