Download full document:

TEXT_T

Designates any piece of text.

This topic lists the expressions that are provided by this class.

AFTER_REGEX(re regex)

Selects the text after the portion that matches the given regular expression argument. The first match is returned when multiple matches occur in the text. The match may occur anywhere within the text - if you wish to "anchor" this, use "^" at the start of the regex and/or "$" at the end of the regex. When the regular expression does not match the given string, a Text object of length of 0 is returned.

Example: HTTP.REQ.HEADER("etag").AFTER_REGEX(re/KX/) will select "DAPPER" from "KXDAPPER".

Parameters(expressions not allowed):

regex -
Regular Expression

Returns: text_t

AFTER_STR_ANY(text_tpatset_name)

Selects the Text that is present after the first occurrence of any of the strings that are bound to the patset named by the string argument. If there is no match to any of the strings bound to the patset in the current Text object then the result Text object has 0 length.

The patset cannot have strings longer than 255 characters.

Parameters(expressions not allowed):

patset_name -
Pattern Set Name

Returns: text_t

AFTER_STR(text_ts)

Selects the Text that is present after the first occurrence of the string argument. If there is no match for the argument in the current Text then the result Text object has 0 length. The input string cannot be bigger than 255 characters.

Parameters(expressions not allowed):

s -
String

Returns: text_t

APPEND(bool_atb)

Appends the given boolean's string representation to the current string.

Parameters:

b -
the boolean value to append.

Returns: text_t

APPEND(double_ati)

Appends the given double's string representation to the current string.

Parameters:

i -
the double value to append.

Returns: text_t

APPEND(ip_address_ataddr)

Appends the given IPv4's string representation to the current string.

Parameters:

addr -
the IPv4 address to append.

Returns: text_t

APPEND(ipv6_address_ataddr)

Appends the given IPv6's string representation to the current string.

Parameters:

addr -
the IPv6 address to append.

Returns: text_t

APPEND(ipv6_subnet_ataddr)

Appends the given IPv6 subnet's string representation to the current string.

Parameters:

addr -
the IPv6 subnet to append.

Returns: text_t

APPEND(mac_address_ataddr)

Appends the given MAC's string representation to the current string.

Parameters:

addr -
the MAC address to append.

Returns: text_t

APPEND(num_ati)

Appends the given number's string representation to the current string.

Parameters:

i -
the number value to append.

Returns: text_t

APPEND(text_tstr)

Appends the given string to the current string.

Parameters:

str -
the string to append.

Returns: text_t

APPEND(time_att)

Appends the given time's string representation to the current string.

Parameters:

t -
the time value to append.

Returns: text_t

APPEND(time_att)

Appends the given time's string representation to the current string.

Parameters:

t -
the time value to append.

Returns: text_t

APPEND(num_ati)

Appends the given unsigned long's string representation to the current string.

Parameters:

i -
the unsigned long value to append.

Returns: text_t

APPEND(unsigned_long_ati)

Appends the given unsigned long's string representation to the current string.

Parameters:

i -
the unsigned long value to append.

Returns: text_t

B64DECODE

Decodes the selected text using base64 decoding.

For example, the string "TWFu" is converted to "Man"

Returns: text_t

B64ENCODE

Encodes the selected text using base64 encoding.

For example, the string "Man" is converted to "TWFu"

Returns: text_t

BEFORE_REGEX(re regex)

Selects the text before the portion that matches the given regular expression argument. The first match is returned when multiple matches occur in the text. The match may occur anywhere within the text - if you wish to "anchor" this, use "^" at the start of the regex and/or "$" at the end of the regex. When the regular expression does not match the given string, a Text object of length of 0 is returned.

For example: HTTP.RES.HEADER("content-type").BEFORE_REGEX(re#/#) will select "text" from "text/plain".

Parameters(expressions not allowed):

regex -
Regular Expression

Returns: text_t

BEFORE_STR_ANY(text_tpatset_name)

Selects the Text that is present before the first occurrence of any of the strings that are bound to the patset or datasetnamed by the string argument. If there is no match to any of the strings bound to the patset in the current Text object then the result Text object has 0 length.

The patset cannot have strings longer than 255 characters.

Parameters(expressions not allowed):

patset_name -
Pattern Set Name

Returns: text_t

BEFORE_STR(text_ts)

Selects the Text that is present before the first occurrence of the string argument. If there is no match for the argument in the current Text object then the result Text object has 0 length.

The input string cannot be bigger than 255 characters.

Parameters(expressions not allowed):

s -
String

Returns: text_t

BETWEEN(text_tstart, text_tend)

Results in Boolean TRUE value if length of the Text object is greater than or equal to the sum of the Start and End argument lengths and if the prefix of the Text object matches the Start string argument and if the Suffix of the Text object matches the End string argument.

Parameters:

start -
Start

end -
End

Returns: bool_at

BIN_DECODE(binary_encoding_eencoding)

Decode the encoded input into its original byte sequence. An incorrectly enooded input will result in an Undef error.

Parameters(expressions not allowed):

encoding -
specifies how the bytes are encoded.

Returns: text_t

BIN_ENCODE(binary_encoding_eencoding)

Encode the input byte sequence. Note that BIN_ENCODE(hex_colons) is equivalent to BLOB_TO_HEX().

Parameters(expressions not allowed):

encoding -
specifies how the bytes are to be encoded.

Returns: text_t

BLOB_TO_HEX

Convert to hexadecimal representation and select text.

For example, the byte string abc is converted to 61:62:63.

Returns: text_t

COMPARE(text_ts)

Results in a Number Value which is the result of comparison of the input argument with the Text object. The result is greater than 0 if the Text object is lexicographically greater than the argument. The result is 0 if the Text object and the argument match. The result is less than 0 if the Text object is lexicographically lesser than the argument.

Parameters:

s -
String

Returns: num_at

CONTAINS_ANY(text_tpatset_name)

Results in Boolean TRUE value if the Text contains any of the strings that are bound to the patset or dataset named by the string argument.

Parameters(expressions not allowed):

patset_name -
Pattern Set Name

Returns: bool_at

CONTAINS_INDEX(text_tpatset_name)

Returns the numerical index of the matching string, if the Text contains any of the strings that are bound to the patset or dataset named by the string argument. Returns 0 if there is no match.

Parameters(expressions not allowed):

patset_name -
Pattern Set Name

Returns: num_at

CONTAINS(text_ts)

Results in Boolean TRUE value if the Text contains the string given in the argument. The input string cannot be bigger than 255 characters.

Parameters(expressions not allowed):

s -
String

Returns: bool_at

CRC32

Returns a 32-bit integer computed by applying a CRC (cyclic redundancy check) function to the selected text. This is the CRC function used by Ethernet, MPEG-2, PKZIP, GZIP, PNG, and many other applications. For example, the expression to compute the CRC value of the (first 1000 bytes of the) body of an HTTP request is: HTTP.REQ.BODY(1000).CRC32

Returns: num_at

DECODE_USING_TEXT_MODE

Decodes the selected text using the currently configured text encoding methods like URLENCODED, BACKSLASH_ENCODED, PLUS_AS_SPACE, NOURLENCODED, NO_BACKSLASH_ENCODED and NO_PLUS_AS_SPACE. Text encoding methods are set using SET_TEXT_MODE method.

Returns: text_t

DECRYPT

Decrypt the selected base64-encoded ciphertext using the configured encryptionParams.

Returns: text_t

DECRYPT(binary_encoding_ein_encoding)

Decrypt the selected ciphertext using the configured encryptionParams.

Parameters(expressions not allowed):

in_encoding -
specifies how the input ciphertext is encoded. If the ciphertext is not encoded as specified, causes an Undef error.

Returns: text_t

DECRYPT(text_tencryptionKey)

Decrypt the selected base64-encoded encrypted bytes using the configured encryption key.

Parameters(expressions not allowed):

encryptionKey -
identifies the encryptionKey object to provide the cipher method, mode, padding, key, encrypted format and optional initialization vector (IV).

Returns: text_t

DECRYPT(text_tencryptionKey, binary_encoding_ein_encoding)

Decrypt the selected base64-encoded encrypted bytes using the configured encryption key.

Parameters(expressions not allowed):

encryptionKey -
identifies the encryptionKey object to provide the cipher method, mode, padding, key, encrypted format, and optional initialization vector (IV).

in_encoding -
specifies how the input ciphertext is encoded. If the ciphertext is not encoded as specified, causes an Undef error.

Returns: text_t

DIGEST(digest_method_emethod)

Returns a byte sequence computed by applying the the specified message digest method to the selected text.

Parameters(expressions not allowed):

method -
digest method to apply to the input text

Returns: text_t

ENCRYPT

Encrypt the selected plaintext bytes using the configured encryptionParams. The resulting ciphertext is base64-encoded.

Returns: text_t

ENCRYPT(binary_encoding_eout_encoding)

Encrypt the selected plaintext bytes using the configured encryptionParams.

Parameters(expressions not allowed):

out_encoding -
specifies how the resulting ciphertext is encoded.

Returns: text_t

ENCRYPT(text_tencryptionKey)

Encrypt the selected cleartext bytes using the configured encryption key.

Parameters(expressions not allowed):

encryptionKey -
identifies the encryptionKey object to provide the cipher method, mode, padding, key, encrypted format and optional initialization vector (IV).

Returns: text_t

ENCRYPT(text_tencryptionKey, binary_encoding_eout_encoding)

Encrypt the selected cleartext bytes using the configured encryption key.

Parameters(expressions not allowed):

encryptionKey -
identifies the encryptionKey object to provide the cipher method, mode, padding, key, encrypted format and optional initialization vector (IV).

out_encoding -
specifies how the resulting ciphertext is encoded.

Returns: text_t

ENDSWITH_ANY(text_tpatset_name)

Results in Boolean TRUE value if the Text ends with any of the strings that are bound to the patset or dataset named by the string argument.

Parameters(expressions not allowed):

patset_name -
Pattern Set Name

Returns: bool_at

ENDSWITH_INDEX(text_tpatset_name)

Returns the numerical index of the matching string, if the Text ends with any of the strings that are bound to the patset or dataset named by the string argument. Returns 0 if there is no match.

Parameters(expressions not allowed):

patset_name -
Pattern Set Name

Returns: num_at

ENDSWITH(text_tend)

Results in Boolean TRUE value if a suffix of the Text object matches the string argument.

Parameters:

end -
String

Returns: bool_at

EQUALS_ANY(text_tpatset_name)

Results in Boolean TRUE value if the Text equals any of the strings that are bound to the patset or dataset named by the string argument.

Parameters(expressions not allowed):

patset_name -
Pattern Set Name

Returns: bool_at

EQUALS_INDEX(text_tpatset_name)

Returns the numerical index of the matching string, if the Text equals any of the strings that are bound to the patset or dataset named by the string argument. Returns 0 if there is no match.

Parameters(expressions not allowed):

patset_name -
Pattern Set Name

Returns: num_at

EQ(text_ts)

Results in Boolean TRUE value if the Text object matches the input argument.

Parameters:

s -
String

Returns: bool_at

GET_SIGNED16(uint n, endian_eendianness)

Get the 16-bit signed binary integer at the given offset.

Parameters(expressions not allowed):

n -
Offset in bytes

endianness -
Select little or big endian

Returns: num_at

GET_SIGNED32(uint n, endian_eendianness)

Get the 32-bit signed binary integer at the given offset.

Parameters(expressions not allowed):

n -
Offset in bytes

endianness -
Select little or big endian

Returns: num_at

GET_SIGNED8(uint n)

Get the 8-bit signed binary integer at the given offset.

Parameters:

n -
Offset in bytes

Returns: num_at

GET_UNSIGNED16(uint n, endian_eendianness)

Get the 16-bit unsigned binary integer at the given offset.

Parameters(expressions not allowed):

n -
Offset in bytes

endianness -
Select little or big endian

Returns: num_at

GET_UNSIGNED32(uint n, endian_eendianness)

Get the 32-bit unsigned binary integer at the given offset.

Parameters(expressions not allowed):

n -
Offset in bytes

endianness -
Select little or big endian

Returns: unsigned_long_at

GET_UNSIGNED64(uint n, endian_eendianness)

Get the 64-bit unsigned binary integer at the given offset.

Parameters(expressions not allowed):

n -
Offset in bytes

endianness -
Select little or big endian

Returns: unsigned_long_at

GET_UNSIGNED8(uint n)

Get the 8-bit unsigned binary integer at the given offset.

Parameters:

n -
Offset in bytes

Returns: num_at

GET_URLSET_METADATA(text_turlset_name)

Returns metadata value corresponding to pattern in the urlset. The matching is case-insensitive for domains, but case-sensitive for paths. If no pattern is matched within the urlset, the return value is a NULL string.

For example:

  • HTTP.REQ.HOST.APPEND(HTTP.REQ.URL).GET_URLSET_METADATA("urlset_forbidden") returns value when the combined domain and URL is looked up in the urlset whose name is "urlset_forbidden".
  • Parameters(expressions not allowed):

    urlset_name -
    urlset name

    Returns: text_t