^New\ Doc.* (<- that is from the below example but is actually a poorly
constructed regex because it will search to end of line/string) should work to
escape the space char but that is one of the oddities of regex - knowing which
implementation is being used.
dp
On 2/18/16 3:13 PM, Steven Morgan wrote:
Looks like ClamAV uses what is called the "old library." I don't think this
is POSIX compliant with regard to regular expressions.
Hope this helps,
Steve
On Thu, Feb 18, 2016 at 3:12 PM, Mehmet Avcioglu <meh...@activecom.net>
wrote:
On Feb 18, 2016, at 8:14 PM, Steven Morgan <smor...@sourcefire.com>
wrote:
cdb signatures use a regex library known as "Henry Spencer's regular
expressions." Googling documentation for that should give what you want.
Thank you for the information. I searched out for that and found
documentation, but am not able to get the desired outcome. Henry Spencer’s
regular expressions are supposed to be POSIX compliment and "\s" is valid
for space but I cannot get it to work.
For example I am able to use "^New.Doc.*" to match for "New Doc.xls" but
"^New\sDoc.*" or "^New Doc.*" does not.
Thanks
--
Mehmet Avcioglu
meh...@activecom.net
_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
