Actions
Feature #7114
open
VJ
JL
from_base64: allow matching on decode error
Feature #7114:
from_base64: allow matching on decode error
Effort:
Difficulty:
Label:
Description
Thinking about something like:
file.data; from_base64:strict,set_error; content:"BASE64_ECODE_BUF";
Not entirely sure what the buffer should be set to.
It could be used to make sure base64 at an expected location is valid, so it wouldn't match if it decoded correctly.
file.data; from_base64:strict,set_error; bsize:0;
Would also need to see how to express this, as the bsize here is useless.
Actions