CODEWITHSUNDEEP
c#regex
scryptKiddy
scryptKiddy

Reputation: 477

Replace all trailing spaces before a specific char

I'm parsing snort rules which are notorious for having all kinds of characters. What I'm trying to replace specifically are all the trailing spaces that precede the last closing parenthesis with simply a closing parenthesis:

simple example:

alert tcp any any -> any any (msg: "jons test";     flow: to_server,established;     content:"/ui/"; nocase;    content:"/getlatestversion?ver=";  nocase;   sid:1002496; rev:1;      )

Should be:

alert tcp any any -> any any (msg: "jons test";     flow: to_server,established;     content:"/ui/"; nocase;    content:"/getlatestversion?ver=";  nocase;   sid:1002496; rev:1;)

I've tried 

string newRuleText = Regex.Replace(this.textBox1.Text, "s+\\)$", ")");

and 

 string newRuleText = Regex.Replace(this.textBox1.Text, "\\s+\\)$", ")");

But the newRuleText string still has no changes.

Upvotes: 0

Views: 89

Answers (1)

Pablo A. Revert
Pablo A. Revert

Reputation: 356

The problem is not related with the regular expression which is right. I've executed this:

System.Text.RegularExpressions.Regex.Replace("alert tcp any any -> any any (msg: \"jons test\";     flow: to_server,established;     content:\"/ui/\"; nocase;    content:\"/getlatestversion?ver=\";  nocase;   sid:1002496; rev:1;      )","\\s+\\)$",")")

and the result was:

"alert tcp any any -> any any (msg: \"jons test\";     flow: to_server,established;     content:\"/ui/\"; nocase;    content:\"/getlatestversion?ver=\";  nocase;   sid:1002496; rev:1;)"

May be the ")" is not the last character of the string.

Did you test with "\s+\)"?

If this works then the problem is related with the $, and the ")" is not the last character

Upvotes: 2

Related Questions