[Xymon] Regex escaping in 'cont=' test

[John Thurston]

I'm fighting with the correct escaping and encoding for http content 
checks using the "cont=" tag:

> cont[=COLUMN];URL;[expected_data_regexp|#digesttype:digest]
>   This tag is used to specify a http/https check, where it is also
>   checked that specific content is present in the server response.
. . .
>   The regex is pre-processed for backslash "\" escape sequences.  . .

I can't find the expression to match the string:
    <a href="foo/bar">
(Which I hope your email client isn't going to try to render as html!)

The closest I can manage is:
   a\x20href=\x22foo/bar\x22>

Where \x20 is an ASCII space, and \x22 is a double-quote

If I put a leading \x3D (which is an equal-sign), that renders in the 
search string and obviously doesn't match my supplied content. If, 
however, I put a leading \x3C (which is the less-than sign) the rest of 
the expression is eaten and is not rendered. I've tried leading the \x3C 
with \x5C (which is a backslash), with no effect.

I also tried leading with \x5C\x78\x33\x43 (which is \x3C), which 
renders as such, but does not match my string.

The upshot is, I can match enough of my string to be unique on my page. 
But it seems like something isn't right in the regex escaping and 
cleansing for this test. The supplied string should be accepted as a 
string, but the "<" seems to be interpreted during the parsing instead.

Can anyone else find a way to use a "<" in the regex of the cont= test?


-- 
    Do things because you should, not just because you can.

John Thurston    907-465-8591
John.Thurston at alaska.gov
Department of Administration
State of Alaska