Skip to content

Fix nested repeat warning - #682

Open
kx7m2qd wants to merge 2 commits into
rapid7:mainfrom
kx7m2qd:fix-nested-repeat-warning
Open

Fix nested repeat warning#682
kx7m2qd wants to merge 2 commits into
rapid7:mainfrom
kx7m2qd:fix-nested-repeat-warning

Conversation

@kx7m2qd

@kx7m2qd kx7m2qd commented Aug 23, 2026

Copy link
Copy Markdown

Description

Fixes the "nested repeat operator '+' and '?' was replaced with '*'" warning
that Ruby emits when compiling the Cisco RV Series fingerprint pattern in
xml/snmp_sysdescr.xml.

(?:[A-Z]+)? (a non-capturing group containing "one or more" wrapped in
"optional") is redundant with (?:[A-Z]*) ("zero or more") - both match the
exact same set of strings. Since it's a non-capturing group, there's no
nil-vs-empty-string capture semantics to worry about here (unlike (X+)?
vs (X*) inside a capturing group, which does change behavior).

Motivation and Context

This picks up where #662 left off. That PR proposed a blanket (.+)? ->
(.*) substitution across many patterns in the XML database, but review
found that (a) most of those patterns don't actually produce the warning
under Ruby 3.3, and (b) for capturing groups, (.+)? -> (.*) isn't
semantically safe - it changes an unmatched capture from nil to "",
which breaks branching logic elsewhere in the recog-ruby gem (see
rapid7/recog-ruby, separate PR incoming for that).

So rather than reuse that diff, I re-audited every pattern= attribute in
xml/ directly against Ruby's warning output. Only one pattern in the
entire database actually warns - this one. Everything else is left
untouched.

Relates to rapid7/metasploit-framework#20121 (RegEx Replacement Warning in
smb_version) and supersedes #662.

How Has This Been Tested?

  • Wrote a script that loads every pattern attribute from all 52 files in
    xml/ via Regexp.new under ruby -w and checks stderr for the
    "nested repeat operator" warning. Only xml/snmp_sysdescr.xml's Cisco RV
    pattern triggers it, both before and after cross-checking against Ruby
    3.3.8 behavior reported in review on Fix nested repeat operator warnings in Ruby 3.3 #662.
  • Verified the old and new regex produce identical MatchData#captures for
    all examples in the fingerprint (RV320, RV345-K9) plus a synthetic
    RV320W case, confirming the fix doesn't change matching behavior.
  • Ran bin/recog_verify xml/snmp_sysdescr.xml locally, all examples still
    pass.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)

Checklist:

  • I have updated the documentation accordingly (or changes are not required).
  • I have added tests to cover my changes (or new tests are not required).
  • All new and existing tests passed.

Comment thread .gitignore

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like these changes are specific to your local setup. We generally avoid committing .gitignore changes to this repository unless necessary. Could you please revert this file?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants