[OT] help understanding a PCRE expression (CORRECTION)

[Mike Wright]

Hey everybody,

Reading an article about a fedora kernel vulnerability regression and 
found this PCRE expression

'(<= )\w+'  <--- mistake

'(?<= )\w+' <--- actual expression

I got the "one or more words" part but what is the meaning of the part 
inside the parens?

Thanks

[Barry]

> On 21 Feb 2025, at 17:13, Mike Wright  wrote:
>
> I got the "one or more words" part but what is the meaning of the part inside the parens?

Do a web search for “ pcre re format” and it will take you here https://www.pcre.org/original/doc/html/pcresyntax.html that explains all the syntax.

Barry

[Markus Schönhaber]

21.02.25, 18:12 +0100, Mike Wright:
> Reading an article about a fedora kernel vulnerability regression and 
> found this PCRE expression
>
> '(<= )\w+'  <--- mistake
>
> '(?<= )\w+' <--- actual expression
>
> I got the "one or more words" part but what is the meaning of the part 
> inside the parens?

In the man page for pcrepattern(3) search for "Lookbehind assertions".

[SOLVED][OT] help understanding a PCRE expression (CORRECTION)

[Mike Wright]

On 2/21/25 09:39, Markus Schönhaber wrote:
> 21.02.25, 18:12 +0100, Mike Wright:
> > Reading an article about a fedora kernel vulnerability regression and
> > found this PCRE expression
> > '(<= )\w+'  <--- mistake
> >
> > '(?<= )\w+' <--- actual expression
> >
> > I got the "one or more words" part but what is the meaning of the part
> > inside the parens?
>
> In the man page for pcrepattern(3) search for "Lookbehind assertions".

Danke, Markus.

I've been using RE's in scripting languages for years and had never come 
across "lookbehind assertions".

Appreciate the reference.

:m

[SOLVED][OT] help understanding a PCRE expression (CORRECTION)

[Mike Wright]

> > > '(?<= )\w+' <--- actual expression

For completeness and for anybody else who wondered what that does:

it is looking for words preceded by a space

[Will McDonald]

On Fri, 21 Feb 2025 at 17:13, Mike Wright 
wrote:
> Reading an article about a fedora kernel vulnerability regression and
> found this PCRE expression
>    '(?<= )\w+' <--- actual expression
>
> I got the "one or more words" part but what is the meaning of the part
> inside the parens?

Adding to what others have already stated, you could also use some of the
online regex explainers.

https://regex101.com/ maxes a decent go of breaking down the regex.