LuKreme:
> On 19-Mar-2009, at 04:45, Wietse Venema wrote:
> >> $ ls -1 /usr/local/virtual/ | grep "@" | sed 's/^\([...@]*\)@\(.*\)$/
> >> \/
> >> ^\1_\(.*\)@\2$\/ \1+$...@\2/'
> >>
> >> [email protected] => /^testuser_(.*)@example.com$/
> >> [email protected]
> >
> > This is BROKEN. You are not escaping any of the regexp metacharacters
> > such as '.' and so on.
>
> All righty, I didn't escape the . but since exampleqcom or example$com
> are not valid hostnames and the match is anchored to both the start
> and end of the string AND since it is pulling the data from my own
> list of existing users, I'm not seeing that it's much of a risk.
>
> But sure, you can escape the . if you like, it only adds a few
> characters to the sed portion.
>
> sed 's/^\([...@]*\)@\([^.]*\)\.\(.*\)$/\/^\1_\(.*\)@\2\\.\3$\/ \1+${1}@
> \2\\.\3/'
This is bad advice. Domain names can have more than one ".", and
characters on the left of "@" need escaping too.
Victor's example is safe because it quotes all metacharacters,
Lukreme's example is unsafe.
Wietse
