Stuart Johnston wrote:
cjackson wrote:
Hi,
I flunked the IQ test so I need some help. I want to match all domains
in the body that are not in .com,.org.us,.edu,.gov and .mil. But
there's more. I need to match some characters at the end of the URI
that can often be found there such as >.?)*!"';
The rule would match http://www.go.za and http://www.go.za), but not
match http://www.go.com
Here's my regex that does not work...
m{https?://[^\s/:"')!?>*]+(?<!\.com)(?<!\.net)(?<!\.org)(?<!\.gov)(?<!\.us)(?<!\.edu)(?<!\.mil)(?:"|'|:|\?|!|>|\*|\)|$)}
It works for all of the characters except for an ending "." such as
http://www.go.com.
I have grappled with this for some time and read the pcrepattern.txt
accompanying Exim source, but damn if I can get it to work. Anybody
want to spit out the answer?
Assuming that you are creating a SA rule, have you considered using a
uri test? That way you wouldn't have to worry about the extra
characters at the end. SA would take care of it for you.
Yes, it is a uri test which I patterned after WEIRD_PORTS in 20_uri
Mine is like this...
uri SUSPECT_DOM_CJ =~ <expression>
score SUSPECT_DOM_CJ <score>
I didn't know that SA took care of the ending characters in uri tests.
I'll take another look to consider this. Thanks.
