From 3ca804421e15c843f82b3e0de617590d2dc9b4e8 Mon Sep 17 00:00:00 2001
From: Christian Kreibich <christian@corelight.com>
Date: Mon, 23 Nov 2020 15:04:29 -0800
Subject: [PATCH] Harden diff-remove-timestamps canonifier

This pattern got mislead by matching suffixes of other numbers, and
noramlizing exact 0-timestamps isn't really required.

- Remove eplicit "0.000000" number pattern from timestamp normalization

- Require beginning of line or non-numeric character before the
  beginning of the number replacement
---
 testing/scripts/diff-remove-timestamps | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testing/scripts/diff-remove-timestamps b/testing/scripts/diff-remove-timestamps
index 8ee28c29b9..f7d839c4d6 100755
--- a/testing/scripts/diff-remove-timestamps
+++ b/testing/scripts/diff-remove-timestamps
@@ -9,5 +9,5 @@ else
    sed="sed -E"
 fi
 
-$sed 's/(0\.000000)|([0-9]{9,10}\.[0-9]{1,8})/XXXXXXXXXX.XXXXXX/g' | \
+$sed 's/(^|[^0-9])([0-9]{9,10}\.[0-9]{1,8})/\1XXXXXXXXXX.XXXXXX/g' | \
 $sed 's/^ *#(open|close).(19|20)..-..-..-..-..-..$/#\1 XXXX-XX-XX-XX-XX-XX/g'