On Fri, Jun 29, 2018 at 12:26:34PM -0700, Vern Paxson wrote: > > Just so I have this right: it looks like the preferred would not be > > /(?i foo)/ but rather /(?i)foo/, yes? > > Oh and to follow up on this, so in PCRE does /x((?i)bar)foo/ make the "foo" > part case-insensitive too, or not? It's not obvious to me from the page > you pointed me at, and I don't have an environment set up to definitively > test this.
It does not. So: /x((?i)bar)foo/ is (kind-of [1]) equivalent to /x(?i:bar)foo/ and only makes the bar part case insensitive. /x(?i)barfoo/ would make barfoo case insensitive. I am fine with implementing either (?[flags]) or (?[flags]:[pattern) or both. I hope this makes sense. Johanna [1]: Kind-of, because (?i:bar) is non-capturing, whereas ((?i)bar) captures "bar" in the first capture-variable. Since we don't support capturing at the moment that does not really matter for us - it might be of importance in the future though. _______________________________________________ bro-dev mailing list [email protected] http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
