Yeah, that looks like a bug. Bro's treatment of "^/$" is a bit, let's say, complex unfortunately.
Robin On Thu, Jul 25, 2013 at 11:21 -0500, you wrote: > > [ > https://bro-tracker.atlassian.net/browse/BIT-1042?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13315#comment-13315 > ] > > Brian Little commented on BIT-1042: > ----------------------------------- > > I was using that as an simple example, but it shouldn't match at all. > > The specific problem I have it trying to remove the first . in a domain, using > > print sub(".github.com", /^\./, ""); > #github.com > > This works, however that specific pattern /^\./ also matches this: > > print sub("github.com", /^\./, ""); > #githubcom (note missing .) > > Is "sub" the wrong tool to use for this? It seems to work for other patterns > fine, including the $ (end of string), but not for the start of string > > > Caret in regex pattern doesn't match start of line > > -------------------------------------------------- > > > > Key: BIT-1042 > > URL: https://bro-tracker.atlassian.net/browse/BIT-1042 > > Project: Bro Issue Tracker > > Issue Type: Bug > > Components: Bro > > Affects Versions: 2.1 > > Environment: Ubuntu 12.04 and 13.04. Dependencies from apt-get > > ubuntu repos only. > > Reporter: Brian Little > > Priority: Normal > > Labels: pattern, regex > > Attachments: caret.bro > > > > > > print split_all("some string", /^t/); > > I would expect it to not match ^t, but it matches any t in the string. > > output: > > { > > [1] = some s, > > [3] = ring, > > [2] = t > > } > > expected: > > { > > [1] = some string > > } > > tested on bro 2.1 and github master 2.1-824 > > -- > This message is automatically generated by JIRA. > If you think it was sent incorrectly, please contact your JIRA > administrators: > https://bro-tracker.atlassian.net/secure/ContactAdministrators!default.jspa > For more information on JIRA, see: http://www.atlassian.com/software/jira > _______________________________________________ > bro-dev mailing list > [email protected] > http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev > -- Robin Sommer * Phone +1 (510) 722-6541 * [email protected] ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org/robin _______________________________________________ bro-dev mailing list [email protected] http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
