From 2fb5196b8ff548c2afbf94bea40520e965de14ce Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Tue, 25 Aug 2026 08:55:28 +0200 Subject: [PATCH] detect: forbid trailing junk at the end of index To avoid accepting "email.received: index 1junk;" --- rust/src/detect/uint.rs | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/rust/src/detect/uint.rs b/rust/src/detect/uint.rs index 8be54e7a75..bfa71c1ca4 100644 --- a/rust/src/detect/uint.rs +++ b/rust/src/detect/uint.rs @@ -99,9 +99,15 @@ fn parse_uint_index_nb(s: &str) -> IResult<&str, DetectUintIndex> { } fn parse_uint_index_val(s: &str) -> Option { - let (_s, arg1) = alt((parse_uint_index_precise, parse_uint_index_nb)) + let (s, arg1) = alt((parse_uint_index_precise, parse_uint_index_nb)) .parse(s) .ok()?; + if let Ok((s, _)) = opt(is_a::<&str, &str, nom8::error::Error<_>>(" ")).parse(s) { + if !s.is_empty() { + SCLogError!("Invalid trailing data for index : {s}"); + return None; + } + } Some(arg1) }