Commit Graph

8 Commits (d6f0597c17e2ea50a3de50a8ce3cd6b7a9e25e68)

Author SHA1 Message Date
Jeff Lucovsky 9f8dad7245 transform/base64: flag from_base64 decode errors
from_base64 gave no signal when offset or bytes ran past the input or
nothing decoded, so a later keyword could not tell a failed decode from
a successful one.

It also skipped decoding when bytes equaled the input left after
offset, which the C transform before d8a99e1fdd decoded.

When an earlier transform had left the input in the buffer's own
memory, a strict decode that failed partway wrote decoded bytes over
it: after strip_whitespace, "/Zm9vYmFyYmF6cXV4!!" no longer matched.

Mark the transform SIGMATCH_TRANSFORM_CAN_FAIL and flag these failures,
and allocation failures, with SCInspectionBufferSetError. Decode when
bytes equals the remaining input. In place, decode into a separate
buffer and copy the result over only on success. Call base64_decode
instead of SCBase64Decode.

Issue: 7114
6 days ago
Philippe Antoine e0152178da rust: format detect files
Ticket: 3836
5 months ago
Philippe Antoine 8e39539161 detect/doc: fix broken anchor links
Ticket: 8257
6 months ago
Philippe Antoine d14af54b3b detect/transforms: constify some callbacks arguments
Ticket: 8298
7 months ago
Jason Ish dea3f9e260 rust/detect: convert error.rs and dependent parsers to nom 8
Ticket: #8051
12 months ago
Jeff Lucovsky 03d676531a detect/from_base64: Support keyword w/no opts
Issue: 7853

Support the use of `from_base64` with no optional values. In this case,
the default values for:
- mode RFC4648
- offset: 0
- bytes: buffer size
will be used.
1 year ago
Philippe Antoine d8a99e1fdd transforms: move base64 to rust
Ticket: 7733
1 year ago
Philippe Antoine 8b0d256e6b transform: move rust base64 to dedicated subdirectory 1 year ago