Re: [Mod-security-developers] Hyperscan

[Robert P. <rpa...@fe...>]

Not having PCRE backreferences should definitely be a blocker, as that
significantly limits the flexiblity of the expression language. I also
think that, in most cases, the scope of regex targets is not such that this
would present a significant performance improvement.

On Tue, Apr 5, 2016 at 9:52 AM, Felipe Costa <FC...@tr...> wrote:

>
> Hi,
>
>
> On 4/5/16, 1:53 AM, "Christian Folini" <chr...@ne...>
> wrote:
>
> >It seems to come with the following string attached:
> >
> >> If you need features (e.g. sub-expression capture) or pattern
> >> constructs
> >> (e.g. back-references or arbitrary look around asserts) you may not be
> >> able to use Hyperscan (although we do have a pre-filter mode that can
> >> optimize some cases).
> >
> >->
> http://scanmail.trustwave.com/?c=4062&d=_8SD17SSFxcGTyITZx90bheVWxEf38or3BaqDWrOIQ&s=5&u=https%3a%2f%2f01%2eorg%2fhyperscan%2fblogs%2fgeofflangdale%2f2015%2fwelcome-hyperscan
> >
> >Is not that a blocker?
>
>
> It is not clear to me if this is a blocker. I don't think so. Are you
> concerned
> about the sub-expression capture?
>
>
> It is also not clear if it will really improve the performance, as our
> content
> is usually very small. I guess it is not so hard to test.
>
>
> Br.,
> Felipe “Zimmerle” Costa
> Security Researcher, Lead Developer ModSecurity.
>
> Trustwave | SMART SECURITY ON DEMAND
> www.trustwave.com <http://www.trustwave.com/>
>
>
>
>
>
>
>
>
> >
>
> ________________________________
>
> This transmission may contain information that is privileged,
> confidential, and/or exempt from disclosure under applicable law. If you
> are not the intended recipient, you are hereby notified that any
> disclosure, copying, distribution, or use of the information contained
> herein (including any reliance thereon) is strictly prohibited. If you
> received this transmission in error, please immediately contact the sender
> and destroy the material in its entirety, whether in electronic or hard
> copy format.
>
> ------------------------------------------------------------------------------
> _______________________________________________
> mod-security-developers mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-developers
> ModSecurity Services from Trustwave's SpiderLabs:
> https://www.trustwave.com/spiderLabs.php
>