unquoted pcre values fail
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 65/100
Research direction
Start with the rule parsing and validation path for unquoted pcre values; the issue does not name a file or test, so locate those entry points and add a regression case using the example rule. Check that parsing succeeds and that errors identify the correct option. Done when the example is accepted and the regression test passes.
Written by the indexing model from the issue text.
Description
A rule with an unquoted pcre value like alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"foo"; content:"AA"; pcre:/filename=".*\.php"/i ; sid:1337; rev:1;) fails with the error invalid type '\v' for option content. Suricata happily accepts these.
Also, not sure if it will be relevant after a fix but "content" in the error is probably a mistake.
Slopfix™ here: https://github.com/kallen-vc/gonids/commit/6805d58c56bd220e7f6859b96d03170aac88f513
- Dominant language
- Go
- Stars
- 197
- Forks
- 52
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 21
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from google/gonids
-
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 56/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 58/100
google/gonids#249 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 20/100
Maintainers usually reply within 1 day
Similar issues
-
compress: block buffers get re-zeroed on every call, and the zeroing is immediately overwrittenOpen
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
ClickHouse/ch-go#1218 ·
Maintainers usually reply within 13 days
-
effort:s impact:low raised-by:reviewer risk:low
Difficulty 1/5 Under an hour Newbie friendliness 84/100
medici-finance/assay#4251 · 1 comment ·
Maintainers usually reply within 1 day
-
automation models
Difficulty 1/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
golang-migrate/migrate#1457 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
Maintainers usually reply within 1 day