diff --git a/CHANGES b/CHANGES index a143137297..99fcf27f8b 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,8 @@ +3.3.0-dev.551 | 2020-11-17 15:01:04 -0700 + + * Added unit tests for regex fix (christina23) + + * Improved regex for SMTP parsing (christina23) 3.3.0-dev.548 | 2020-11-17 13:32:57 -0800 diff --git a/VERSION b/VERSION index 4f3edfa80d..40e3177ad6 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.3.0-dev.548 +3.3.0-dev.551 diff --git a/scripts/base/utils/email.zeek b/scripts/base/utils/email.zeek index 898ff9d6ec..903048eafd 100644 --- a/scripts/base/utils/email.zeek +++ b/scripts/base/utils/email.zeek @@ -59,7 +59,7 @@ function split_mime_email_addresses(line: string): set[string] { local output = string_set(); - local addrs = find_all(line, /(\"[^"]*\")?[^,]+/); + local addrs = find_all(line, /(\"[^"]*\")?[^,]+@[^,]+/); for ( part in addrs ) { add output[strip(part)]; diff --git a/testing/btest/Baseline/scripts.base.utils.email/output b/testing/btest/Baseline/scripts.base.utils.email/output index 853a2c5990..6955547403 100644 --- a/testing/btest/Baseline/scripts.base.utils.email/output +++ b/testing/btest/Baseline/scripts.base.utils.email/output @@ -19,3 +19,9 @@ three@example.com, one@example.com, two@example.com } +john.smith@email.com +[john.smith@email.com, jane.doe@email.com] +{ +john.smith@email.com +jane.doe@email.com +} diff --git a/testing/btest/scripts/base/utils/email.zeek b/testing/btest/scripts/base/utils/email.zeek index f45064d1c6..5177ce8cb2 100644 --- a/testing/btest/scripts/base/utils/email.zeek +++ b/testing/btest/scripts/base/utils/email.zeek @@ -15,3 +15,7 @@ s = "ieje one@example.com, eifj two@example.com, asdf three@example.com, one@exa print extract_first_email_addr(s); print extract_email_addrs_vec(s); print extract_email_addrs_set(s); +s = "\"Smith, John\" , \"Doe, Jane\" "; +print extract_first_email_addr(s); +print extract_email_addrs_vec(s); +print extract_email_addrs_set(s);