Custom URL Categories - ending tokens

[mb_equate]

Let's say we want to match a domain in a custom URL category or EDL, including all sub-domains. While most people would expect "youtube.com" to do the job, in a PAN-OS this would only match youtube.com and not content.youtube.com. To achieve the result we must include:

youtube.com

*.youtube.com

I can live with that... however in PAN-OS 10 admins are now served a recommendation to use an ending token such as ./?&=;+ when building custom URL categories in the web UI, and if such a token is not present the condition may match more than intended. The example provided for "xyz.com." (note the dot) will match xyz.com.random.com and a suggestion is given to enter the domain as 'xyz.com/.' (again note the dot).

I have two questions regarding this statement

1. Is the dot at the end of these statements a mistake? I'd expect "xyz.com." to match xyz.random.com but "xyz.com/." should only match any path on xyz.com beginning with a dot (e.g. ./index.html).

2. If so, does that mean all my implementations with "xyz.com" will be matching phishing domains like "xyz.com.random.com"? And why doesn't the same logic apply to subdomains i.e. "xyz.com" matches "random.xyz.com" as well as just "xyz.com".

3. I'm sure different people wrote these parts of the UI, because in the Custom URL Category box recommends just using a forward slash (no dot).

4. Clearly I cannot count

[reaper]

i think that last dot is a mistake

if you add a domain 'xyz.com' it could also match xyz.compooter.com (but not xyz.com.compooter.com) because you didn't 'terminate' after your tld and it simply matches characters in a token (anything between dots is a token). a  dot at the end signifies there must be a dot followed by another token, so that would force some sort of tailing fqdn bit (xyz.com. = xyz.com.tld ) a slash at the end 'ends' the fqdn part/token as to prevent phishing and 'happy mistakes' (xyz.com/ will still match xyz.com and xyz.com/index.html but no longer xyz.compooter.com) 

T