From: "David B Funk" <[EMAIL PROTECTED]>
On Thu, 22 Jun 2006, Ramprasad wrote:
Is the Evilnumbers ruleset not too heavy
But the numbers are also mangled
eg
1-22-33 could be written in numerous ways just adding spaces in between
randomly
I am doing regex match something like
/1 *- *2 *2 *- *3 *3 */
Any inputs ?
Yes, as SA collapses multiple spaces down to a single space (in 'body'
tests), you only need to look for a single instance of the space,
not an unlimited number. Also you can omit that final ' *' as it's
an optional "tail" match, thus the rule will work without it.
Out of curiosity what would SA do with <tab><space><tab><space>?
One hopes it is smart enough to collapse that, now. Indications in
the past from writing rules files indicate that this is not a normal
parsing feature of perl.
("body<tab><space><space>RuleName<space><tab>{stuff}" has given me
trouble in the past. These days I am careful not to mix spaces and
tabs so I don't know for sure if this has been solved.)
{^_^}
