From bde55578d66c90a59070f496fbc15a3476192a82 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Sun, 30 Oct 2011 09:19:06 +0100 Subject: [PATCH] Override HTP IDS personality normalizing the query string to lowercase. Bug #362. --- src/app-layer-htp.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c index c0a34f9cc9..a34d5d8b3b 100644 --- a/src/app-layer-htp.c +++ b/src/app-layer-htp.c @@ -953,6 +953,11 @@ static void HTPConfigure(void) SCLogDebug("LIBHTP personality set to %s", HTPLookupPersonalityString(personality)); } + + /* The IDS personality by default converts the path (and due to + * our query string callback also the query string) to lowercase. + * Signatures do not expect this, so override it. */ + htp_config_set_path_case_insensitive(cfglist.cfg, 0); } else { SCLogWarning(SC_ERR_UNKNOWN_VALUE, @@ -1099,6 +1104,11 @@ static void HTPConfigure(void) SCLogDebug("LIBHTP personality set to %s", HTPLookupPersonalityString(personality)); } + + /* The IDS personality by default converts the path (and due to + * our query string callback also the query string) to lowercase. + * Signatures do not expect this, so override it. */ + htp_config_set_path_case_insensitive(htp, 0); } else { SCLogWarning(SC_ERR_UNKNOWN_VALUE,