Suricata

How do you see this interact with other keywords?

file_data; content:"window.location="; ignore_whitespace; content:"something"; distance:0; within:10; isdataat:!1,relative;

Would the second content and the isdataat also run on some stripped buffer? If so it might make more sense to have something like:

file_data; ignore_whitespace; content:"window.location="; content:"something"; distance:0; within:10; isdataat:!1,relative;

Or even something ugly like:

file_data_ignore_whitespace; content:"window.location="; content:"something"; distance:0; within:10; isdataat:!1,relative;

I believe the second option would be most practical for the purpose of reducing pcre usage.

Will this also eliminate nulls (0x00)? This would help in matching on unicode text among other things.

in a buffer like " a b c d" would the expected result be "abcd" or something else? Would all whitespace be stripped?

Victor Julien wrote:

in a buffer like " a b c d" would the expected result be "abcd" or something else? Would all whitespace be stripped?

Well, I think there we should either remove all whitespace and smush the buffer together, or replace all whitespace instances with a single space. So (?:\t\r\n\s\x00)+ becomes \s. I don't think it really matters on the sig writing side, I think whichever has the least amount of overhead on the sensor would be best.

In your original example of 'window . location = ' the best result would probably be 'window.location=' ?

I think it would be the best result.

I agree, stripping out whitespace would be best, especially for \x00. Turning \x00+ to \x20 would negate changing \x00 at all.