[Rspamd-Users] Regex – how to do it right?

[G.W. Haywood]

Hi there,

On Thu, 4 Jan 2024, Andrew Lewis via Users wrote:

> ...
> You'd want something similar to as below I suppose:
>
> config['regexp']['PAKETE_TEST'] = {
>  -- use square quotes to avoid escaping, set match type
>  re = [[/ *<p>Kunden.*<\/p>/{sa_raw_body}]],
>  score = 10.0,
> }

A couple of points about the regex itself:

1. If the " *" at the beginning does mean "zero or more spaces" what's
the purpose of that?  It seems to me unlikely to be a valuable test.

2. The ".*" after "Kunden" would be much better written as a limited
range, because otherwise for example the regex engine can find itself
trying to match megabytes of base64-encoded garbage which is *never*
going to match, so it's just wasting CPU.  If you're not careful with
things like this in regexes processing overhead can grow exponentially
and you can end up DoSing yourself.

-- 

73,
Ged. (BJA 1st dan, 1983. :)