Independent subexpressions

Independent subexpressions allow starting another regular expression from inside a variable expression.

The function used for starting the subexpression is “regex()”. The “cancel” function must always be called after a match in a subexpression. This function stops the execution of the subexpression and frees resources. The “cancel” function is always called without parentheses “()” unlike other functions.

Subexpressions are useful for splitting a single complex regular expression into two. For example, ".*&filename=[^&]{256}" breaks the guideline of not using ".*" or "<expr>{n,m}" with a large m in the middle of a regular expression. The following illustration shows how to circumvent this limitation by using an independent subexpression.

Example of independent subexpression use

# This fingerprint detects an HTTP parameter file name with value longer than # 256 bytes
(?x)
.*&filename=(?[
    regex(
        [^&]{256}(?[sid(),cancel])
    )
])