RegEx Question on BASE64 certificate string

[rudi]

Hello,

meanwhile I realized, that base64 encoded  certificates never ever will have a "\x0A" within the valid characters forming the certificate information, so it should be safe to simply kick all occurrences showing up between "-----BEGIN CERTIFICATE----- " and "-----END CERTIFICATE-----"

But what I would like to know is, what regex to use to eliminate a certain substring from a given string showing up after 64 characters, repeatedly as often as it might occur?

 

(?:\\x0a)(.{64})(?:\\x0a) .....

And what would be the appropriate replacement string to give back everything except the "kicked" \xA0 (line feeds)? 

 

-----BEGIN CERTIFICATE-----\x0AMIIGujCCBaKgAwIBAgITWgAA+jp9Hn80U4lGVwAAAAD6OjANBgkqhkiG9w0BAQsF\x0AADBfMRYwFAYKCZImiZPyLGQBGRYGaW50ZXJuMRgwFgYKCZImiZPyLGQBGRYIZ29l\x0A
<snip>
BgEEAYI3FAIDoBgMFm1lY0BhZC5nb2VwZmVydC5pbnRlcm6BFU0uRWNrYXJkdEBn\x0Ab2VwZmVydC5kZTANBgkqhkiG9w0BAQsFAAOCAQEAbEFtOCNryTkAdrzvz7pegQk+\x0A1hnYpAjrrYu4gYf6RhJG/SplYgLwkNk76L2YcYM7gT42J+moe4uV9Q/plmn1IKHM\x0AsFpU0nbddpOqAms8XgreZy6fEZtG2iCjUS76AMK2cqXxOQ2cfts2YAh+EyuGL+8C\x0AelrQihdZ89GHS72lWanSFSddKaS/+vFynK0+lmM+IaoSU83t+UURqOMx130lpGkB\x0AlzxJTi76NA0Nk+/M+YIjjHQJne/Io+mqlhEuv1wINpPQCUNWcg16wpwuH6fi5DMV\x0AXIEi3085i5CIC85AFbMqK5sNdP7C6FAobEUn+89Yb/gO0BhmXexugCvtQNLThQ==\x0A-----END CERTIFICATE-----\x0A

 

[jchd]

Can't you just use StringReplace($s, "\x0A", "") ???

[rudi]

Well, no, this is, to be honest, not for autoit, it's a pure regex question (nginx, PCRE 2)

Edited September 19, 2023 by rudi

[jchd]

You probably can do the equivalent of:

Local $s = _
    "blah ... blah" & @LF & _
    "-----BEGIN CERTIFICATE-----\x0A" & _
    "MIIGujCCBaKgAwIBAgITWgAA+jp9Hn80U4lGVwAAAAD6OjANBgkqhkiG9w0BAQsF\x0A" & _
    "ADBfMRYwFAYKCZImiZPyLGQBGRYGaW50ZXJuMRgwFgYKCZImiZPyLGQBGRYIZ29l\x0A" & _
    "BgEEAYI3FAIDoBgMFm1lY0BhZC5nb2VwZmVydC5pbnRlcm6BFU0uRWNrYXJkdEBn\x0A" & _
    "b2VwZmVydC5kZTANBgkqhkiG9w0BAQsFAAOCAQEAbEFtOCNryTkAdrzvz7pegQk+\x0A" & _
    "1hnYpAjrrYu4gYf6RhJG/SplYgLwkNk76L2YcYM7gT42J+moe4uV9Q/plmn1IKHM\x0A" & _
    "sFpU0nbddpOqAms8XgreZy6fEZtG2iCjUS76AMK2cqXxOQ2cfts2YAh+EyuGL+8C\x0A" & _
    "elrQihdZ89GHS72lWanSFSddKaS/+vFynK0+lmM+IaoSU83t+UURqOMx130lpGkB\x0A" & _
    "lzxJTi76NA0Nk+/M+YIjjHQJne/Io+mqlhEuv1wINpPQCUNWcg16wpwuH6fi5DMV\x0A" & _
    "XIEi3085i5CIC85AFbMqK5sNdP7C6FAobEUn+89Yb/gO0BhmXexugCvtQNLThQ==\x0A" & _
    "-----END CERTIFICATE-----\x0A" & @LF & _
    "blah ... blah" & @LF

Local $t = StringRegExpReplace($s, "\\x0A", Chr(0x0A))

ConsoleWrite($t)

 

Edited September 19, 2023 by jchd

[AspirinJunkie]

17 hours ago, rudi said:

But what I would like to know is, what regex to use to eliminate a certain substring from a given string showing up after 64 characters, repeatedly as often as it might occur?

The question here is: Do you mean that the substring is already known to you but may only be matched after 64 characters and not when it occurs within the first 64 characters?
Or do you mean that you first want to see which string appears after 64 characters and then replace it accordingly?

The first would be possible in a pattern:

\A.{64}(*SKIP)(*FAIL)|\\x0A

The second, however, rather not.
So you would really have to proceed in two steps here.
So first extract and store in a variable (in nginx I think I used map or set for this) and then reuse this variable in the replacement pattern.

 

17 hours ago, rudi said:

And what would be the appropriate replacement string to give back everything except the "kicked" \xA0 (line feeds)? 

The replacement string would be easy as jchd showed.
The opposite - just matching what doesn't is \\x0a - is a bit more complicated:

(?s)((?<findnot>\\x0A)(*SKIP)(*FAIL)|(?>.+?(?=\g<findnot>|\Z)))

 

Edited September 20, 2023 by AspirinJunkie

[rudi]

@jchd that's what I realized as well: The substring "\x0A" does never show up within the value data of a certificate.

 

This is a task from a work colleague, this is how he solved it now (without regex).

But the question is still interesting: Is it possible to remove a substring at certain positions (here: all 64 characters) of the given string by regex, if it appears?

The certificate strings to be processed do not all have /x0A = linefeeds in the string.

 

Tomorrow I'll take a closer look to the suggestion of @AspirinJunkie, thanks for all replies.