`shExpMatch()`

Shell-glob match of str against pattern; * matches any sequence, ? one character. The whole string must match.

shExpMatch(str, pattern)  →  boolean

The helper libraries convert the glob into a regular expression. * also matches dots, so shExpMatch(host, "*example.com") matches notexample.com; use "*.example.com". Matching on url instead of host lets a query string such as ?r=example.com trigger the rule.

Example

if (shExpMatch(host, "*.example.com") || host == "example.com") {
  return "DIRECT";
}

Engine notes

Engine	Behaviour	Source
chromium	Converts the glob to a RegExp escaping only '.', so ( ) \| keep their regex meaning.	code, verified 2026-10-04 services/proxy_resolver/pac_js_library.h@cb6eb0e7
firefox	Same conversion as Chromium (escapes '.', maps * and ?).	code, verified 2026-10-04 netwerk/base/ascii_pac_utils.js@3f73c528

Availability

Derived from each engine's vendored helper library plus its native bindings (see engines).
Function	chromium <=51	chromium >=52	firefox all	pacparser <=1.4.6	pacparser 1.5.0	pacparser >=1.5.1	reference all
`shExpMatch`	yes	yes	yes	yes	yes	yes	yes

Related rules

Trailing * in a host pattern matches attacker-controlled suffixes PAC-X002
Leading * without a dot matches look-alike domains PAC-X004
Pattern with leading and trailing * is a substring match PAC-X009
Hostname pattern applied to url instead of host PAC-C001
IP range matched as a text prefix PAC-X006