double extension

Forum|Forum|10 years ago
February 8, 2016
1 reply
4549 views

Hi all,

I'm trying to block mail attachment with double extension, like "SomeFile.doc.exe"

I wrote a regexp "\.\w{3}\.\w{3}$" but it's not working.

Any idea?

Thanks

ede_pfau

SuperUser

I'd broaden the regex to include shorter extensions as well, as in "\.\w{1,3}\.\w{1,3}$". Or more than 3 substrings separated by dots. The full pattern would allow an arbitrary string just in front: ".+?\.\w{1,3}\.\w{1,3}$". The '?' is necessary to not let the first part consume all of the filename ('greedy').

And that's where the tricky part begins: which scope of regex does FortiOS support? 'greedy'/'non-greedy', lookahead, named matches,...? I can't test that right now but wouldn't be too surprised if there are limitations.