Wireshark-dev: [Wireshark-dev] display filter scanner.l possible weirdness

From: Richard Sharpe <realrichardsharpe@xxxxxxxxx>
Date: Mon, 22 Aug 2022 06:42:46 -0700
Hi folks,

In trying to introduce my contexts approach for display filters to
handle embedded/recursive structures in 802.11 Information Elements
(TLVs) I came across this in epan/dfilter/scanner.l:

-----------------------------
-               ([.][-+[:alnum:]_:]+)+[.]{0,2} |
-[-+[:alnum:]_:]+([.][-+[:alnum:]_:]+)*[.]{0,2} {
+              ([.][-+[:alnum:]_]+)+[.]{0,2} |
+[-+[:alnum:]_]+([.][-+[:alnum:]_]+)*[.]{0,2} {
------------------------------

Basically, the original scanner allowed solons (:) in field names. I
had to change that since I needed to parse out colons separately in
the grammar. It almost looks like someone made a mistake and assumed
they needed ':]' in contexts where that was not necessary.

I do not believe anyone uses colons in filter strings and did not
think it was possible.

Does anyone think this will be a problem?

Also, are there automated tests for the dfilter stuff? I have been
using dftest to test my changes but it would be good to see if I have
disturbed anything.

-- 
Regards,
Richard Sharpe
(何以解憂?唯有杜康。--曹操)(传说杜康是酒的发明者)