[clamav-users] Filename Regex

[Noel Jones]

You may have more luck with the POSIX character class [[:space:]]
rather than shorthand \s.


  -- Noel Jones


On 2/18/2016 5:22 PM, Dennis Peterson wrote:
> ^New\ Doc.* (<- that is from the below example but is actually a
> poorly constructed regex because it will search to end of
> line/string) should work to escape the space char but that is one of
> the oddities of regex - knowing which implementation is being used.
> 
> dp
> 
> On 2/18/16 3:13 PM, Steven Morgan wrote:
>>
>> Looks like ClamAV uses what is called the "old library." I don't
>> think this
>> is POSIX compliant with regard to regular expressions.
>>
>> Hope this helps,
>> Steve
>>
>> On Thu, Feb 18, 2016 at 3:12 PM, Mehmet Avcioglu
>> <mehmet at activecom.net>
>> wrote:
>>
>>>> On Feb 18, 2016, at 8:14 PM, Steven Morgan <smorgan at sourcefire.com>
>>> wrote:
>>>> cdb signatures use a regex library known as "Henry Spencer's
>>>> regular
>>>> expressions." Googling documentation for that should give what
>>>> you want.
>>> Thank you for the information. I searched out for that and found
>>> documentation, but am not able to get the desired outcome. Henry
>>> Spencer’s
>>> regular expressions are supposed to be POSIX compliment and "\s"
>>> is valid
>>> for space but I cannot get it to work.
>>>
>>> For example I am able to use "^New.Doc.*" to match for "New
>>> Doc.xls" but
>>> "^New\sDoc.*" or "^New Doc.*" does not.
>>>
>>> Thanks
>>>
>>> -- 
>>> Mehmet Avcioglu
>>> mehmet at activecom.net
>>>
>>> _______________________________________________
>>> Help us build a comprehensive ClamAV guide:
>>> https://github.com/vrtadmin/clamav-faq
>>>
>>> http://www.clamav.net/contact.html#ml
>>>
>> _______________________________________________
>> Help us build a comprehensive ClamAV guide:
>> https://github.com/vrtadmin/clamav-faq
>>
>> http://www.clamav.net/contact.html#ml
> 
> _______________________________________________
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml