topic Re: RegEx Help Needed in Network Security

RegEx Help Needed

terrygwazdosky — Mon, 11 Mar 2019 18:22:25 GMT

I'm trying to write a regular expression to block files with the extension of .lnk, but I can't get the end of line anchor ($) to work. So far I've come up with "\.[Ll][Nn][Kk]" and that blocks "test.lnk" but it also blocks "test.lnk.txt". I tried "\.[Ll][Nn][Kk]$" but it doesn't work. What am I doing wrong?

Re: RegEx Help Needed

Kureli Sankar — Fri, 06 Aug 2010 22:55:21 GMT

I hope this helps. I found the following sample in the link below:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940e04.shtml#cre

regex urllist1 ".*\.([Ee][Xx][Ee]|[Cc][Oo][Mm]|[Bb][Aa][Tt]) HTTP/1.[01]"


!--- Extensions such as .exe, .com, .bat to be captured and 
!--- provided the http version being used by web browser must be either 1.0 or 1.1

-KS

Re: RegEx Help Needed

Magnus Mortensen — Sat, 07 Aug 2010 02:57:49 GMT

Terry,

The ASA/PIX Regex engine does not suppor the end of string anchor ($). Bug CSCsm89915 has been filed as an enhancement to get this functionality into the regex engine. Unfortunately there has been no movement on that enhancement sine 2008. If this is something that would be helpful in your production environment, please contact your account team (if applicable) so they can help drive this bug.

- Magnus