Project

General

Profile

Bug #418

Stray backslashes should be escaped in PrintRawUriFp()

Added by Will Metcalf over 6 years ago. Updated about 6 years ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:

Description

To avoid confusion with actual escaped characters this function should escape stray backslashes.

Example:

nc www.openinfosecfoundation.org 80
GET /foo/\x80 HTTP/1.0                                         

HTTP/1.1 404 Not Found
Date: Fri, 02 Mar 2012 19:41:33 GMT
Server:  
Content-Length: 206
Connection: close
Content-Type: text/html; charset=iso-8859-1


In Suricata this request will look like this in the http.log.
03/02/2012-14:24:34.652663 <hostname unknown> [**] /foo/\x80 [**] <useragent unknown> [**] <no referer> [**] GET [**] HTTP/1.0 [**] 404 [**] 206 bytes [**]....

Similar request in an Apache log..

127.0.0.1 - - [01/Feb/2012:09:23:52 -0600] "GET /foo/\\x80 HTTP/1.0" 404 484 "-" "-" 

History

#1 Updated by Victor Julien about 6 years ago

  • Description updated (diff)
  • Status changed from New to Assigned
  • Assignee changed from Victor Julien to Anoop Saldanha
  • Estimated time set to 2.00 h

Anoop can you look into this as part of the buffer api work?

#3 Updated by Victor Julien about 6 years ago

  • Status changed from Assigned to Closed
  • % Done changed from 0 to 100

Applied, thanks Anoop!

Also available in: Atom PDF