PHPIDS regex cannot be compiled about apache-scalp

[GoogleCodeExporter]

The regexp is quite complex yeah, I cannot really help you but saying that I 
believe
the regexp is not well formed. Just a simple fact, the parenthesis don't match.

Did you try with the php-ids engine to see if it was compiling correctly -- 
which I
double? If not, you might want to report it there.

I still leave this issue open since I'm not sure what the problem exactly is.

Original comment by [email protected] on 24 Apr 2009 at 2:15

[GoogleCodeExporter]

Original comment by [email protected] on 24 Apr 2009 at 2:18

• Added labels: Usability

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

same thing still happening

Original comment by [email protected] on 26 Jul 2009 at 8:38

[GoogleCodeExporter]

Remove the bloc lines numbered 45, and it will work.
This kind of regexp are hardley readable...

Original comment by [email protected] on 28 Dec 2009 at 5:38

[GoogleCodeExporter]

fgeek@example:~$ ./scalp-0.4.py -l sites/example.org/log/access.log 
error: the filters file (XML) doesn't exist
please download it at 
https://svn.php-ids.org/svn/trunk/lib/IDS/default_filter.xml

File default_filter.xml still has that regexp and should be removed/changed.


b9a147a93ade7540982ba792e54cc8a6a427a9d1  default_filter.xml
dd4c6a2800e7ebb135a61526a88c231901cf5599  scalp-0.4.py

Original comment by [email protected] on 1 Jul 2010 at 5:37

[GoogleCodeExporter]

IWFM: Removed filter id 44,45,46 from .xml 

Original comment by [email protected] on 30 Aug 2010 at 8:09

[GoogleCodeExporter]

I've found a few links to this in the historical updates wiki ( trac ) which 
show this section changing in rule 45: 
"<id>45</id><rule><![CDATA[(?:union\s*(?:all|distinct|[(!@]*)\s*[([]*\s*select)|
(?:\w+\s+like\s+\"

I've found that there are versions with "(!@]*)?\s*" and "(!@]*)*\s*", but 
older versions have "(!@]*)\s*".

I've found that the last version permits it to compile and run fine ( although 
the developers must be seeing some misidentification or they wouldn't fix it.. 
;-)

HTH, tom.

Original comment by [email protected] on 25 Oct 2010 at 3:27

[GoogleCodeExporter]

Number 73 '(?i:(\%SYSTEMROOT\%))' doesn't compile either.

Original comment by [email protected] on 6 Jan 2013 at 12:14

[GoogleCodeExporter]

The most up to date file is here:

https://raw.github.com/PHPIDS/PHPIDS/master/lib/IDS/default_filter.xml

Original comment by [email protected] on 5 Sep 2013 at 3:42