From 01e20c91fbcc1c4841b942d6f97aed0ac155d029 Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Sun, 25 Feb 2024 10:00:45 -0500 Subject: [PATCH] doc/transform: Correct typo --- doc/userguide/rules/transforms.rst | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/doc/userguide/rules/transforms.rst b/doc/userguide/rules/transforms.rst index c20bd6e598..e536757f29 100644 --- a/doc/userguide/rules/transforms.rst +++ b/doc/userguide/rules/transforms.rst @@ -96,7 +96,7 @@ to_uppercase Converts the buffer to uppercase and passes the value on. -This example alerts if ``http.uri`` contains ``THIS TEXT HAS BEEN CONVERTED TO LOWERCASE`` +This example alerts if ``http.uri`` contains ``THIS TEXT HAS BEEN CONVERTED TO UPPERCASE`` Example:: @@ -216,12 +216,14 @@ There are defaults for each of the options: - ``offset`` defaults to ``0`` and must be less than ``65536`` - ``mode`` defaults to ``rfc4648`` -Note that both ``bytes`` and ``offset`` may be variables from `byte_extract` and/or `byte_math`. +Note that both ``bytes`` and ``offset`` may be variables from `byte_extract` and/or `byte_math` in +later versions of Suricata. They are not supported yet. Mode ``rfc4648`` applies RFC 4648 decoding logic which is suitable for encoding binary data that can be safely sent by email, used in a URL, or included with HTTP POST requests. -Mode ``rfc2045`` applies RFC 2045 decoding logic which supports strings, including those with embedded spaces. +Mode ``rfc2045`` applies RFC 2045 decoding logic which supports strings, including those with embedded spaces, +line breaks, and any non base64 alphabet. Mode ``strict`` will fail if an invalid character is found in the encoded bytes.