From 2a0cb1f3daa2c58021b10ff88f2e6519a2c91d8a Mon Sep 17 00:00:00 2001 From: Shivani Bhardwaj Date: Mon, 10 Oct 2022 16:41:09 +0530 Subject: [PATCH] doc: update base64_decode notes --- doc/userguide/rules/base64-keywords.rst | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/doc/userguide/rules/base64-keywords.rst b/doc/userguide/rules/base64-keywords.rst index 4d704292bc..7daf0c2603 100644 --- a/doc/userguide/rules/base64-keywords.rst +++ b/doc/userguide/rules/base64-keywords.rst @@ -27,6 +27,10 @@ This option makes ``offset`` skip bytes relative to the previous match. The content match that you want to decode relative to must be the first match in the stream. +.. note:: ``base64_decode`` follows RFC 4648 by default i.e. encounter with any character that is not found in the base64 alphabet leads to rejection of that character and the rest of the string. + + See Redmine Bug 5223: https://redmine.openinfosecfoundation.org/issues/5223 and RFC 4648: https://www.rfc-editor.org/rfc/rfc4648#section-3.3 + base64_data -----------