Python re2.match函数代码示例

    def on_call(self, call, process):
        if call["api"] == "CreateServiceA" or call["api"] == "CreateServiceW":
            starttype = call["arguments"]["start_type"]
            servicename = call["arguments"]["service_name"]
            servicepath = call["arguments"]["filepath"]
            if starttype < 3:
                self.mark(
                    service_name=servicename,
                    service_path=servicepath,
                )

        elif call["status"]:
            regkey = call["arguments"]["regkey"]
            regvalue = call["arguments"]["value"]
            in_whitelist = False
            for whitelist in self.whitelists:
                if re.match(whitelist, regkey, re.IGNORECASE):
                    in_whitelist = True
                    break
            if not in_whitelist:
                for indicator in self.regkeys_re:
                    if re.match(indicator, regkey, re.IGNORECASE) and regvalue != "c:\\program files\\java\\jre7\\bin\jp2iexp.dll":
                        self.mark(
                            reg_key=regkey,
                            reg_value=regvalue,
                        )

 def test_bug_527371(self):
     # bug described in patches 527371/672491
     self.assertEqual(re.match(r'(a)?a','a').lastindex, None)
     self.assertEqual(re.match(r'(a)(b)?b','ab').lastindex, 1)
     self.assertEqual(re.match(r'(?P<a>a)(?P<b>b)?b','ab').lastgroup, 'a')
     self.assertEqual(re.match("(?P<a>a(b))", "ab").lastgroup, 'a')
     self.assertEqual(re.match("((a))", "a").lastindex, 1)

    def on_call(self, call, process):
        continueChain = False
        if call["status"]:
            if call["api"] == "LdrGetProcedureAddress":
                resolved = self.get_argument(call, "FunctionName")
                if resolved and resolved == "IsWow64Process":
                    continueChain = True

            elif call["api"] == "NtCreateEvent":
                if self.lastapi == "LdrGetProcedureAddress" and self.chain:
                    event = self.get_argument(call, "EventName")
                    if event and re.match("^[0-9A-F]{32}$", event):
                        continueChain = True

            elif call["api"] == "NtCreateSection":
                if self.lastapi == "NtCreateEvent" and self.chain:
                    attribs = self.get_argument(call, "ObjectAttributes")
                    if attribs and re.match("^[0-9A-F]{32}$", attribs):
                        continueChain = True

            elif call["api"] == "CreateThread":
                if self.lastapi == "NtCreateSection" and self.chain:
                    return True

        self.chain = continueChain
        self.lastapi = call["api"]

    def test_getlower(self):
        import _sre
        self.assertEqual(_sre.getlower(ord('A'), 0), ord('a'))
        self.assertEqual(_sre.getlower(ord('A'), re.LOCALE), ord('a'))
        self.assertEqual(_sre.getlower(ord('A'), re.UNICODE), ord('a'))

        self.assertEqual(re.match("abc", "ABC", re.I).group(0), "ABC")
        self.assertEqual(re.match("abc", u"ABC", re.I).group(0), "ABC")

 def test_bug_448951(self):
     # bug 448951 (similar to 429357, but with single char match)
     # (Also test greedy matches.)
     for op in '','?','*':
         self.assertEqual(re.match(r'((.%s):)?z'%op, 'z').groups(),
                          (None, None))
         self.assertEqual(re.match(r'((.%s):)?z'%op, 'a:z').groups(),
                          ('a:', 'a'))

 def test_ignore_case(self):
     self.assertEqual(re.match("abc", "ABC", re.I).group(0), "ABC")
     self.assertEqual(re.match("abc", u"ABC", re.I).group(0), "ABC")
     self.assertEqual(re.match(r"(a\s[^a])", "a b", re.I).group(1), "a b")
     self.assertEqual(re.match(r"(a\s[^a]*)", "a bb", re.I).group(1), "a bb")
     self.assertEqual(re.match(r"(a\s[abc])", "a b", re.I).group(1), "a b")
     self.assertEqual(re.match(r"(a\s[abc]*)", "a bb", re.I).group(1), "a bb")
     self.assertEqual(re.match(r"((a)\s\2)", "a a", re.I).group(1), "a a")
     self.assertEqual(re.match(r"((a)\s\2*)", "a aa", re.I).group(1), "a aa")
     self.assertEqual(re.match(r"((a)\s(abc|a))", "a a", re.I).group(1), "a a")
     self.assertEqual(re.match(r"((a)\s(abc|a)*)", "a aa", re.I).group(1), "a aa")

 def test_bug_418626(self):
     # bugs 418626 at al. -- Testing Greg Chapman's addition of op code
     # SRE_OP_MIN_REPEAT_ONE for eliminating recursion on simple uses of
     # pattern '*?' on a long string.
     self.assertEqual(re.match('.*?c', 10000*'ab'+'cd').end(0), 20001)
     self.assertEqual(re.match('.*?cd', 5000*'ab'+'c'+5000*'ab'+'cde').end(0),
                      20003)
     self.assertEqual(re.match('.*?cd', 20000*'abc'+'de').end(0), 60001)
     # non-simple '*?' still used to hit the recursion limit, before the
     # non-recursive scheme was implemented.
     self.assertEqual(re.search('(a|b)*?c', 10000*'ab'+'cd').end(0), 20001)

 def test_search_star_plus(self):
     self.assertEqual(re.search('x*', 'axx').span(0), (0, 0))
     self.assertEqual(re.search('x*', 'axx').span(), (0, 0))
     self.assertEqual(re.search('x+', 'axx').span(0), (1, 3))
     self.assertEqual(re.search('x+', 'axx').span(), (1, 3))
     self.assertEqual(re.search('x', 'aaa'), None)
     self.assertEqual(re.match('a*', 'xxx').span(0), (0, 0))
     self.assertEqual(re.match('a*', 'xxx').span(), (0, 0))
     self.assertEqual(re.match('x*', 'xxxa').span(0), (0, 3))
     self.assertEqual(re.match('x*', 'xxxa').span(), (0, 3))
     self.assertEqual(re.match('a+', 'xxx'), None)

    def test_re_escape(self):
        p=""
        # This had to change from the original test of range(0,256)
        # because we can't support non-ascii non-utf8 strings
        for i in range(0, 128):
            p = p + chr(i)
            self.assertEqual(re.match(re.escape(chr(i)), chr(i)) is not None,
                             True)
            self.assertEqual(re.match(re.escape(chr(i)), chr(i)).span(), (0,1))

        pat=re.compile(re.escape(p))
        self.assertEqual(pat.match(p) is not None, True)
        self.assertEqual(pat.match(p).span(), (0,128))

    def on_call(self, call, process):
        if call["api"] == "RegSetValueExA":
            key = self.get_argument(call, "FullName")
            if key and re.match(self.configkey, key):
                value = self.get_argument(call, "ValueName").lower()
                if value == "autoconfigurl":
                    self.keybuf = self.get_argument(call, "Buffer")

        elif call["api"] == "NtWriteFile":
            path = self.get_argument(call, "HandleName")
            if path and re.match(self.configpath, path):
                buf = self.get_argument(call, "Buffer")
                if "user_pref" in buf and "network.proxy.autoconfig_url" in buf:
                    tmp = buf.split("(")[1].split(")")[0].split(",")[1]
                    self.pathbuf = tmp.strip().replace("\"","").replace("'","")

    def run(self):
        # will need to turn this into an evented signature later, as IE will read the existing value of some of these entries
        # and write them back as the same value
        reg_indicators = [
        ".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet\\ Settings\\\\ProxyEnable$",
        ".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet\\ Settings\\\\ProxyServer$",
        ".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet\\ Settings\\\\ZoneMap\\\\ProxyBypass$",
        ".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet\\ Settings\\\\ProxyOverride$",
        ".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet\\ Settings\\\\Wpad\\\\.*",
        ]
        whitelist = [
        ".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet\\ Settings\\\\Wpad\\\\WpadLastNetwork$",
        ".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet\\ Settings\\\\Wpad\\\\[^\\\\]*\\\\WpadDecisionReason$",
        ".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet\\ Settings\\\\Wpad\\\\[^\\\\]*\\\\WpadDecisionTime$",
        ".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet\\ Settings\\\\Wpad\\\\[^\\\\]*\\\\WpadDecision$",
        ".*\\\\SOFTWARE\\\\(Wow6432Node\\\\)?Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet\\ Settings\\\\Wpad\\\\[^\\\\]*\\\\WpadNetworkName$",
        ]
        # Get rid of a PDF false positive
        if "file" in self.results["target"]:
            if "PDF" in self.results["target"]["file"]["type"]:
                del reg_indicators[0]

        for indicator in reg_indicators:
            matches = self.check_write_key(pattern=indicator, regex=True, all=True)
            if matches:
                for match in matches:
                    foundwhite = False
                    for white in whitelist:
                        if re.match(white, match, re.IGNORECASE):
                            foundwhite = True
                    if not foundwhite:
                        return True

        return False

    def doPrivmsg(self, irc, msg):
        """ Handle everything.

        The name is misleading.  This hook actually gets called for all
        IRC activity in every channel.
        """
        # We don't handle this if we've been addressed because invalidCommand
        # will handle it for us.  This prevents us from accessing the db twice
        # and therefore crashing.
        if (msg.addressed or msg.repliedTo):
            return

        channel = msg.args[0]
        if irc.isChannel(channel) and self.allow_unaddressed_karma:
            irc = callbacks.SimpleProxy(irc, msg)
            agent = msg.nick
            line = msg.args[1].strip()

            # First try to handle karma commands
            words = line.split()
            for word in words:
                if word[-2:] in self.karma_tokens:
                    self._do_karma(
                        irc, channel, agent, word, line, explicit=False)

        blacklist = self.registryValue('naked_ping_channel_blacklist')
        if irc.isChannel(channel) and not channel in blacklist:
            # Also, handle naked pings for
            # https://github.com/fedora-infra/supybot-fedora/issues/26
            pattern = '\w* ?[:,] ?ping\W*$'
            if re.match(pattern, line):
                admonition = self.registryValue('naked_ping_admonition')
                irc.reply(admonition)

def validate_regex(check, key, pattern):
    """Validates that a dict value matches a regex."""
    if key not in check:
        return

    if not re.match(pattern, check[key]):
        raise ValueError('Invalid {0}: {1}'.format(key, check[key]))

    def run(self):
        # There are more, but these are the only ones I've observed
        execs = [
            "exe",
            "scr",
        ]
        exts = {
            "doc": "Word 97-2003 document",
            "docx": "Word 2007+ document",
            "xls": "Excel 97-2003 spreadsheet",
            "xlsx": "Excel 2007+ spreadsheet",
            "ppt": "PowerPoint 97-2003 file",
            "pptx": "PowerPoint 2007+ file",
            "jpeg": "JPEG image",
            "jpg": "JPG image",
            "png": "PNG image",
            "gif": "GIF image",
            "pdf": "PDF document",
            "xml": "XML document",
        }
        pat = ".*[ _\-\.](?P<FakeExtension>{0})\.(?:{1})".format(
            "|".join(exts.keys()), "|".join(execs))
        if self.results["target"]["category"] == "file":
            check = re.match(pat, self.results["target"]["file"]["name"])
            if check:
                ext = check.group("FakeExtension")
                self.description = self.description.format(ext,
                                                           exts[ext.lower()])
                return True

        return False

    def on_call(self, call, process):
        # Legacy, modern Dyre doesn't have hardcoded hashes in
        # CryptHashData anymore
        iocs = [
            "J7dnlDvybciDvu8d46D\\x00",
            "qwererthwebfsdvjaf+\\x00",
        ]
        pipe = [
            "\\??\\pipe\\3obdw5e5w4",
            "\\??\\pipe\\g2fabg5713",
        ]
        if call["api"] == "CryptHashData":
            buf = self.get_argument(call, "Buffer")
            if buf in iocs:
                self.cryptoapis = True
            tmp = re.sub(r"\\x[0-9A-Fa-f]{2}", "", buf)
            if self.compname in tmp:
                if re.match("^" + self.compname + "[0-9 ]+$", tmp):
                    self.cryptoapis = True
        elif call["api"] == "HttpOpenRequestA":
            buf = self.get_argument(call, "Path")
            if len(buf) > 10:
                self.networkapis.add(buf)
        elif call["api"] == "NtCreateNamedPipeFile":
            buf = self.get_argument(call, "PipeName")
            for npipe in pipe:
                if buf == npipe:
                    self.syncapis = True
                    break

        return None