Skip to content

Find domains next to a port, a trailing dot or punctuation, and with one character labels - #94

Open
4ktLuffy wants to merge 1 commit into
GOVCERT-LU:masterfrom
4ktLuffy:fix/domain-boundaries
Open

4ktLuffy wants to merge 1 commit into
GOVCERT-LU:masterfrom
4ktLuffy:fix/domain-boundaries

Conversation

@4ktLuffy

Copy link
Copy Markdown

Fixes #93.

dom_regex now finds domains followed by a port, a closing quote or bracket, or , ; : !, domains with one-character labels (only the TLD needs two characters), and drops a trailing FQDN/sentence dot. An HTML entity such as . does not end a domain, so src="other.example.com" does not yield other.example. The labels are matched possessively, which keeps the search linear: on 80 000 chars of a.b.a.b… it takes 5 ms instead of 145 ms.

Tests: 21 new cases in tests/test_ioc_boundaries.py (15 fail without the change, including negatives like e.g., a.m., U.S.A). Full suite and --run-slow performance tests pass; the one failure, test_get_obfuscated_ip_rejects[12345678901], also fails on master on macOS (inet_aton).

…one character labels

dom_regex missed example.com:8080, www.a.example.com, example.com. and domains followed by
, ; : ! or a quote or bracket. The labels are now matched possessively, which also makes the
search linear for input like "a.b.a.b..." (80 000 chars: 145 ms before, 5 ms now).

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

dom_regex misses domains with a port, a one-character label, a trailing dot or adjacent punctuation

1 participant