Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

semicolons can't be escaped in unquoted values

Open Beginner friendly
  • Is something wrong?
#252 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
67/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
go
Domain
backend

Research direction

Start by reading the parser code that handles unquoted option values and the existing tests for semicolon-delimited options; the issue does not name specific files. Reproduce the example rule and check how the escaped semicolon and backslash appear in the parsed metadata. Done means an escaped semicolon does not end the value, with the parser behavior covered by a test.

Written by the indexing model from the issue text.

Description

Suricata allows for escaped semicolons in unquoted values like in this rule alert ip any any -> any any (metadata:a b\;c; sid:1;). Weirdly, it actually includes the \ in the metadata: "metadata":{"a":["b\\;c"]}.

I haven't actually run into this in the wild but it came up while investigating https://github.com/google/gonids/issues/251. Seems rare and weird but maybe still worth fixing.

Slopfix™: Don't end an unquoted option value at an escaped semicolon

Dominant language
Go
Stars
197
Forks
51
Avg merge
1d 1h
Merged PRs (30d)
21

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from google/gonids

All issues in google/gonids

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.