[mod-security-users] RE: Regex Problem

[Carpenter, S. (OCTO) <Sco...@dc...>]

After much trail and error, I finally figured out to leave off the
http://test/test/com <http://test/test/com>  and only use the URI portion.

SecFilter "!testpage/[0-9]{6}/test\.jpg\?[0-1]\.[0-9]{1,20}"

Works fine.
>  -----Original Message-----
> From: 	Carpenter, Scott (OCTO)  
> Sent:	Wednesday, January 28, 2004 5:56 PM
> To:	'mod...@li...'
> Subject:	Regex Problem
> 
> I am trying to create at SecFilter rule:
> 
> SecFilter
> "!(http://test\.test\.com/testpage/[0-9]{6}/test\.jpg\?[0-1]\.[0-9]{1,20}
> <http://test\.test\.com/testpage/[0-9]{6}/test\.jpg\?[0-1]\.[0-9]{1,20}>
> )"
> 
> 
> To stop any but url's like:
> 
> http://test.test.com/testpage/200011/test.jpg?0.12679403621457513
> <http://test.test.com/testpage/200011/test.jpg?0.12679403621457513> 
> http://test.test.com/testpage/200015/test.jpg?0.7822027277630665
> <http://test.test.com/testpage/200015/test.jpg?0.7822027277630665> 
> http://test.test.com/testpage200032/test.jpg?0.21133485109517996
> <http://test.test.com/testpage200032/test.jpg?0.21133485109517996> 
> 
> My regex is working with three different regex testing tools. Am I just
> brain dead, or did I miss something?
> 
> Initial 
> Secfilter "!testpage"
> Secfilter "!jpg"
> 
> Produced the expected results, but I want to tighten it down as much as
> possible.
> 
> 
> Thanks,
> 
> Scott Carpenter
> DCERT Engineer
> City Wide Information Technology Security (CWITS)
> 222 Massachusetts Ave. N.W.
> Brock Annex
> Washington, DC 20001
> (202) 727-8784- voice
> (703) 395-0302 - cell
> sco...@dc...
> 
>