Suricata

After more discussion, we think an event based approach may make more sense. Question is how.

One way would be to use detect events, like how the swf decoding uses. Problem would be that those are set on a per packet level, so most likely a different scope than the buffer that was decoded.

Perhaps a better way would be to create a per buffer event facility. Then the scope would remain the same.

file.data; from_base64:strict; buffer-event:base64_invalid_input;

A more generic scenario could be to use absent_or:

drop ... file.data; from_base64:strict; absent_or; content:"evil";

https://github.com/OISF/suricata/pull/12337