dimanche 3 février 2019

how do I make an if statement for regex, related to the match in the list that has been added using python?

import re

data = []
cleandata = []

def matchMethod(arg):
  data.append(x.group(0))
  y = data[0]
  cleandata.append(y)
  y = y.split(" /")
  cleandata.append(y[0]).
 .
 .
#a few lines of code have been used to slicing the string and appended to another list, and cannot be replaced

pattern = {
        "(?=GET |POST ).*": matchMethod,
}

with open ('modsec_auditnormal.log','r') as ifile:
   filelistnow = ifile.readlines()
   for item in filelistnow:                
      for k, v in pattern.items():
         x = re.match(k,item)
         if x:
         v(x)

the snippet above is python 3.7 which I run on the Spyder IDE, the IDE has a variable explorer feature. In the explorer variable, the data list [] holds items, recorded with various variations. But those when enter the cleandata [] list are always the same item, the GET method only, while POST does not.

I have a problem with slicing items on data [], before appending to cleandata [] So i want to make the condition for data work after the code "data.append(x.group(0))", but before "cleandata.append(y)" . The item containing the GET and POST method has a pattern. In the data [] in the initial position is index 0, will start with the item containing the GET method. The distance from the GET item to the GET / POST method is 10 steps, while the POST method to the GET / POST method is 12 steps.

I tried it by implementing:

if re.match (r "(GET). *", data [0]):
         y = data [0::10]
  elif re.match (r "(POST). *", data [0]):
         y = data [0::12]

it will be like this,

def matchMethod(arg):
    data.append(x.group(0))
    if re.match(r"(GET ).*", data[0]) :
        y = data[0::10]
    elif re.match(r"(POST ).*", data[0]):
        y = data[0::12] 
    cleandata.append(y)
    y = y.split(" /")
    cleandata.append(y[0])

the result is:

File "D:/....", line 19, in matchMethod
    y = y.split(" /")
AttributeError: 'list' object has no attribute 'split'

Aucun commentaire:

Enregistrer un commentaire