Ruleset Engine gains wildcard matching and expansion

Cloudflare has extended wildcard support across all products built on its Ruleset Engine, a decade after wildcards first appeared in Page Rules. The update adds wildcard operators, a new wildcard_replace() function for Single Redirects, and a simplified "wildcard pattern" UI for building redirects. The underlying matching logic is now available as an open-source Rust crate.

Page Rules originally let users define URL patterns with asterisks and reference captured segments in targets using $1-style syntax. When Single Redirects replaced Page Rules' URL Forwarding in 2022, that flexibility was lost. Users had to emulate wildcards with expressions combining functions such as starts_with(), substring(), and concat(). For example, redirecting https://example.com/old-path/* to a new path required a filter and an expression that manually extracted a substring by hard-coded offset.

The new wildcard operators eliminate that necessity. Both wildcard (case insensitive) and strict wildcard (case sensitive) can be applied to any string field the Ruleset Engine exposes, including host, URI, headers, cookies, user agent, and country fields. In a WAF rule, for instance, a wildcard match on the User Agent field can capture any request whose string begins with "Mozilla/" and contains the expected Firefox tokens, tolerating case variations like "mozilla" versus "Mozilla".

2478-1-hero

What the update adds

Three pieces of new functionality are shipping:

  • Wildcard operators: wildcard matches case insensitively, mirroring old Page Rules behavior; strict wildcard is case sensitive. Both support the asterisk metacharacter for pattern matching.
  • wildcard_replace() function: Available in Single Redirects, this function substitutes captured wildcard segments into a target URL using the ${<X>} reference syntax, where <X> is the match index.
  • Simplified redirect UI: A new "wildcard pattern" interface under the Redirect Rules tab lets users define source and target patterns without writing expressions.

The capture-and-replacement behavior makes dynamic redirects straightforward. A pattern like https://example.com/*/t*st can forward to https://${1}.example.com/t${2}st, so that https://example.com/uk/test resolves to https://uk.example.com/test and https://example.com/images/toast to https://images.example.com/toast.

2478-2
2478-3

Why a new wildcard crate

The Ruleset Engine is written in Rust, so the team evaluated existing crates before building its own. The regex crate was rejected because it requires translating wildcard syntax into regular expressions, escaping special characters in the process. The wildmatch crate, purpose-built for wildcard patterns, was closer but had three shortcomings: it only handles UTF-8 strings while the Ruleset Engine is byte-oriented, it does not support escape sequences such as \* for a literal asterisk, and it offers no way to capture matched segments for use in replacement expressions.

Wildcard matching has worst-case quadratic complexity: the time scales with the pattern length multiplied by input length, or more precisely O(p + ℓ + s ⋅ ℓ), where p is pattern length, ℓ is input string length, and s is the number of asterisks. To bound CPU consumption, the Ruleset Engine caps patterns at 8 asterisk metacharacters.

The resulting implementation draws on Kurt's 2016 iterative algorithm and Krauss' 2014 optimizations. It provides byte-oriented matching, escape sequence support, and capture of substrings that match wildcard metacharacters, which is required for implementing wildcard_replace().

wildcard_replace(
http.request.full_uri, 
&quot;https://example.com/*/page/*&quot;, 
&quot;https://example.com/products/${1}?page=${2}&quot;
)

The crate is published on crates.io under the name wildcard, with the source repository on GitHub.

Availability and documentation

Wildcard support is rolling out immediately to all plans at no cost, with no beta registration required. It applies across Cache Rules, Compression Rules, Configuration Rules, Custom Errors, Origin Rules, Redirect Rules, Snippets, Transform Rules, the WAF, Waiting Room, and other Ruleset Engine-based products.

Documentation has been updated for the wildcard operators and the wildcard_replace() function. Feedback is being collected in the community forums.

2478-4