Are you talking about the use of m'' as the regex delimiter?
Yes.
It will probably work just fine for the foreseeable future, as long as the
input validation of rules files is lenient.
I think you may have a very hard time removing the m<char> matching
delimiters from SA. I suspect there are at least hundreds of rules like that
in the release database. I have about a hundred local rules of my own that
use that.
Any time I have more than one backslash in a pattern, I use an alternate
delimiter (usually single quote) so that I don't have to escape all the
backslashes in the rule body. I'm not a fan of obfuscated rule bodies where
it is impossible to tell what it is intended to match. My experience is that
any time you have to write \\\\ or \\\\\\ multiple times in a rule body, you
are almost guaranteed to get the number of backslahses wrong, and the rule
won't work. But of course it may work in some cases (like the one you used
to test it) while not working in general.
I don't have time in my life to deal with that sort of thing. It caused me
enough grief when I started writing rules 20 years ago, which is why I
started using m'.
BTW, that particular rule dates from RulesEmporium days, which was what,
2005 or so?
Loren
