[clamav-users] Filename Regex

[Dennis Peterson]

^New\ Doc.* (<- that is from the below example but is actually a poorly 
constructed regex because it will search to end of line/string) should work to 
escape the space char but that is one of the oddities of regex - knowing which 
implementation is being used.

dp

On 2/18/16 3:13 PM, Steven Morgan wrote:
>
> Looks like ClamAV uses what is called the "old library." I don't think this
> is POSIX compliant with regard to regular expressions.
>
> Hope this helps,
> Steve
>
> On Thu, Feb 18, 2016 at 3:12 PM, Mehmet Avcioglu <mehmet at activecom.net>
> wrote:
>
>>> On Feb 18, 2016, at 8:14 PM, Steven Morgan <smorgan at sourcefire.com>
>> wrote:
>>> cdb signatures use a regex library known as "Henry Spencer's regular
>>> expressions." Googling documentation for that should give what you want.
>> Thank you for the information. I searched out for that and found
>> documentation, but am not able to get the desired outcome. Henry Spencer’s
>> regular expressions are supposed to be POSIX compliment and "\s" is valid
>> for space but I cannot get it to work.
>>
>> For example I am able to use "^New.Doc.*" to match for "New Doc.xls" but
>> "^New\sDoc.*" or "^New Doc.*" does not.
>>
>> Thanks
>>
>> --
>> Mehmet Avcioglu
>> mehmet at activecom.net
>>
>> _______________________________________________
>> Help us build a comprehensive ClamAV guide:
>> https://github.com/vrtadmin/clamav-faq
>>
>> http://www.clamav.net/contact.html#ml
>>
> _______________________________________________
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml