Strip whitespace from buffers
'window . location = '
We have to write pcres to account for this possible whitespace such as:
It would be very useful if we could write this as:
file_data; content:"window.location="; ignore_whitespace;
Updated by Victor Julien over 4 years ago
How do you see this interact with other keywords?
file_data; content:"window.location="; ignore_whitespace; content:"something"; distance:0; within:10; isdataat:!1,relative;
Would the second content and the isdataat also run on some stripped buffer? If so it might make more sense to have something like:
file_data; ignore_whitespace; content:"window.location="; content:"something"; distance:0; within:10; isdataat:!1,relative;
Or even something ugly like:
file_data_ignore_whitespace; content:"window.location="; content:"something"; distance:0; within:10; isdataat:!1,relative;
If we preprocess the file_data buffer to strip whitespace or do some other transformation, we're essentially creating a new buffer and a new inspect engine internally. Related ticket #1006.
Updated by Jason Williams over 4 years ago
Victor Julien wrote:
in a buffer like " a b c d" would the expected result be "abcd" or something else? Would all whitespace be stripped?
Well, I think there we should either remove all whitespace and smush the buffer together, or replace all whitespace instances with a single space. So (?:\t\r\n\s\x00)+ becomes \s. I don't think it really matters on the sig writing side, I think whichever has the least amount of overhead on the sensor would be best.