CODEWITHSUNDEEP
phpregex
Dwza
Dwza

Reputation: 6565

Strip Base64 strings from long text

I really wonder if I'm really the first one asking this question or am I so blind to finde some about this...

I have a longer text and I want to strip base64 encoded strings of it

I am a text and have some lines with some content

There are more than one line but sometimes I have

aSBhbSBhIG5vcm1hbCB0ZXh0IHRoYXQgd2FzIGNvZ

GVkIGluIGJhc2UgNjQgYW5kIG5vdyBpIHdhcyB0cmFu

c2xhdGVkIGJhY2sgdG8gYmxhbmsgdGV4dGZvcm1hd

C4gaSB0aGFuayB5b3UgZm9yIHBheWluZyBhdHRlbnRp

b24uIGJ5ZQ==

and this is what I want to strip / extract by using php

As you can see there is base64 encoded data in the text and I want to extract/strip these lines.

I allready tried a lot of regex samples from SO something like

$regex = '@^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$@m';
preg_match($regex, $content, $output_array );

but this not solved anything...

What I need is a regex that only selects the base strings...

Is this even possible ? I mean is base64 selectable by regex ? I guess :)

EDIT: String-Source is the content of an email

EDIT2: Guess the best syntax for this case your be so track strings that has more than one uppdercased character and can have numbers and has no whitespaces. But regex is not my daily bread :D

Upvotes: 3

Views: 921

Answers (2)

ArSeN
ArSeN

Reputation: 5258

First of all: You can not reliably do this!

Why?

Simple, the point why base64 is so great in some cases is, that is encodes all the data with "standard" characters. Those that are used in normal texts, sentences, and yes, even words.

Background

Is "Hello" a base64-encoded string? Well, yes, in the meaning of it is "valid base64 encoded". It probably returns a lot of jibberish, but it is a base64-ok string.

Therefore, you can only decide on a length after which you consider characters connected without any space to be base64 encoded. Of course in languages such as german you may have quite some trouble here, as there a compound nouns, such as "Bäckerfachverkäuferinnenhosenherstellungsautomatenzuliefererdienst" or such (just made that up).

Workaround

So on the length you have to decide yourself, an then you can go with this: 

[a-zA-Z0-9\+\/\=]{20,}

Also see the example here: https://regex101.com/r/uK5gM1/1

I considered "20" to be the minimum length for "base64 encoded stuff" here, but as said, it is up to you. Also, as a small side note, the = is not really encoded content but fill bytes, but I still added it to the regex.

Edit: Gnah.. you can even see in my example that I did not catch the last line :) When changing the number to 12 it works fine here, but there may be words with more than 12 characters ... so - as said, not really reliably possible in this manner.

Upvotes: 2

Alex Blex
Alex Blex

Reputation: 37048

For the snippet in the example /^\w{53}$/gm does the job. If you can rely on length of course.

EDIT:

Considering circumstances and updates, I would go with /\n([\w=\n]{50,})\n/gs but without metadata it may be tricky to guess mime-type of the decoded stuff, and almost impossible to restore filenames etc.

Upvotes: 1

Related Questions