import java.util.regex.Matcher;
import java.util.regex.Pattern;
public class Example {
public static void main(String[] args) {
final String regex = "(?i)(%(25){0,}20|\\s)*(%(25){0,}24|\\$)(%(25){0,}20|\\s)*(%(25){0,}7B|\\{)(%(25){0,}20|\\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\\s)*(%(25){0,}3A|:)[\\w\\%]+(%(25){1,}3A|:)(%(25){1,}2F|\\/)[^\\n]+";
final String string = "Sample Log4j strings:\n"
+ "${JNDI:LDAP://\n"
+ "${JNDI:LDAPS://\n"
+ "${JNDI:RMI://\n"
+ "${JNDI:DNS://\n"
+ "${JNDI:NIS://\n"
+ "${JNDI:IIOP://\n"
+ "${JNDI:CORBA://\n"
+ "${JNDI:NDS://\n"
+ "${JNDI:HTTPS://\n"
+ "${JNDI:HTTP://\n"
+ " $ { JNDI :LDAPS://\n"
+ " $ { JNDI :LDAPS://\n"
+ "${jNDi:l%252564ap://\n\n"
+ "JNDI = %6A%6E%64%69\n"
+ "jndi = %4A%4E%44%49\n\n"
+ "Multi-encoding log4j strings (without spaces):\n"
+ "%24%7B%6A%6E%64%69%3A%2F\n"
+ "%2524%257B%256A%256E%2564%2569%253A\n"
+ "%2524%257B%256A%256E%2564%2569%253A%252F\n"
+ "%252524%25257B%25256A%25256E%252564%252569%25253A%25252F\n\n"
+ "Multi-URL Encoded string characters:\n"
+ "(?i)\n"
+ "(%(25){0,}20|\\s)*\n"
+ "(%(25){0,}24|$)\n"
+ "(%(25){0,}20|\\s)*\n"
+ "(%(25){0,}7B|{)\n"
+ "(%(25){0,}20|\\s)*\n"
+ "(%(25){0,}(6A|4A)|J)\n"
+ "(%(25){0,}(6E|4E)|N)\n"
+ "(%(25){0,}(64|44)|D)\n"
+ "(%(25){0,}(69|49)|I)\n"
+ "(%(25){0,}20|\\s)*\n"
+ "(%(25){0,}3A|:)\n"
+ "(%(25){0,}2F|\\/)\n"
+ "[\\w\\%]+\n"
+ "(%(25){0,}3A|:)\n"
+ "(%(25){0,}2F|\\/)\n";
final Pattern pattern = Pattern.compile(regex, Pattern.MULTILINE);
final Matcher matcher = pattern.matcher(string);
while (matcher.find()) {
System.out.println("Full match: " + matcher.group(0));
for (int i = 1; i <= matcher.groupCount(); i++) {
System.out.println("Group " + i + ": " + matcher.group(i));
}
}
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Java, please visit: https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html