[mod-security-users] regex for matching urls

[Peter W. <prw...@gm...>]

Greetings,

I'm trying to create a mod_security rule that uses regexes to match a
certain piece of text, but only if it is found within a URL. Here is
the initial attempt:

SecFilterSelective HTTP_Referer|ARGS
"[a-z]+://[\w\-_.]*poker[\w\-_.]*\.[a-z]{2,}"

This does *not* match 'poker' if it is found within a URL (e.g.
http://www.high-stakes-poker.com/). However, if you take the
'[a-z]+://' off of the beginning, it *does* work:

SecFilterSelective HTTP_Referer|ARGS "[\w\-_.]*poker[\w\-_.]*\.[a-z]{2,}"

What is wrong with '[a-z]+://' ? I tried escaping the /'s, and that
didn't seem to make any difference.

Thanks,

Peter
-- 
Peter R. Wood | email: prw...@gm... | blog: http://prwdot.org/