I'm trying to get my head around regular _expression_ matching.
body MANGLED_CASH
/(?!cash)\b[cǩ\(][_\W]{0,[EMAIL PROTECTED],5}[sz5\$][_\W]{0,5}h\b/i
My
understanding of rule matching was that the '(?!cash' bit required an | (or)
in order to work. Can anyone break down the logic of how SA tests this
line?
Not sure why you think an OR is required.
OTOH, I'm not at all sure why there is a \b there between (?!cash) and the
mangled matching code. That \b either should be inside the parends with
cash, or shoudn't be there at all. Given the overall rule it would be
more efficient to have it inside the parends. There should also be
another \b before the '(?!' part to keep from matching 'cash' inside the
middle of some other word, I suppose.
Then again, I don't really see a reason to have
the \b check there at all. If someone is going to spell cash using
mangled letters, I don't see that you care much if it is a stand-alone
word.
In any case, what the (?!cash) part is saying
is 'the word 'cash' does not appear here', followed by a word break (the \b)
followed by a mangled spelling of cash, followed by another word break.
Which doesn't really work, but the intent was to catch a mangled spelling of
cash, but not a non-mangled spelling.
A better version would probably be
body MANGLED_CASH
/(?!cash)[cǩ\(][_\W]{0,[EMAIL PROTECTED],5}[sz5\$][_\W]{0,5}h/i
Loren
