zeek/testing/btest/scripts/base/utils/email.zeek
Jon Siwek 170752fa99 Fix extract_first_email_addr() to really return the first email
The use of find_all() in extract_email_addrs_vec() extracted occurrences
to an intermediate set and thus lost any sense of ordering.

This changes extract_email_addrs_vec() to use find_all_ordered() and
return all occurrences of email addresses found in the argument,
included duplicates, with their order of occurrence preserved.
2020-08-11 11:26:21 -07:00

17 lines
646 B
Text

# @TEST-EXEC: zeek -b %INPUT >output
# @TEST-EXEC: btest-diff output
@load base/utils/email
local s = "one@example.com two@example.com three@example.com one@example.com";
print extract_first_email_addr(s);
print extract_email_addrs_vec(s);
print extract_email_addrs_set(s);
s = "one@example.com,two@example.com,three@example.com,one@example.com";
print extract_first_email_addr(s);
print extract_email_addrs_vec(s);
print extract_email_addrs_set(s);
s = "ieje one@example.com, eifj two@example.com, asdf three@example.com, one@example.com";
print extract_first_email_addr(s);
print extract_email_addrs_vec(s);
print extract_email_addrs_set(s);