Independent subexpressions
Independent subexpressions allow starting another regular expression from inside a variable expression.
The function used for starting the subexpression is “regex()
”. The “cancel
” function must always be called after a match in a subexpression. This function stops the execution of the subexpression and frees resources. The “cancel
” function is always called without parentheses “()” unlike other functions.
Subexpressions are useful for splitting a single complex regular expression into two. For example, ".*&filename=[^&]{256}
" breaks the guideline of not using ".*
" or "<expr>{n,m}
" with a large m in the middle of a regular expression. The following illustration shows how to circumvent this limitation by using an independent subexpression.
Example of independent subexpression use
# This fingerprint detects an HTTP parameter file name with value longer than # 256 bytes
(?x)
.*&filename=(?[
regex(
[^&]{256}(?[sid(),cancel])
)
])