Expand description
Python re compatibility layer for the detection pattern table.
The spec 4.0.2 table is authored as Python regex sources and the conformance
corpus compares the canonical source string carried by every threat. This
module compiles those sources for the regex crate with equivalent
semantics for the constructs the table uses.
Translation rules:
- a leading
(?i)is left in place (the crate honors it); builtin IGNORECASE is expressed by prepending(?i)when the source does not carry its own global flag; - sources embedding
(?-i:...)wrappers compile without a global case fold: the wrapper scopes case sensitivity back for the wrapped body and the crate honors that natively; \Z(Python absolute end) becomes\z;- a bare
$outside a class means “end of string or just before a trailing newline” in Python and becomes(?:\n?\z).
Constructs the crate rejects (lookaround, backreferences) fail compilation here; those table entries are served by structural matchers instead.