Project

General

Profile

Actions
Copy link

Bug #720

closed

file keywords - rule grammar - double quotes

Added by Peter Manev over 11 years ago. Updated over 8 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

alert http any any -> any any (msg:"FILE Check PDF "; fileext:"pdf"; filestore; sid:9999993; rev:2;)
alert http any any -> any any (msg:"FILE  Check PDF "; fileext:pdf; filestore; sid:9999994; rev:2;)

both rules above load - notice the missing double quotes around fileext:pdf.
This is the case with most of the file keywords.

Actions
Copy link
 #1

Updated by Peter Manev over 11 years ago

  • Subject changed from file keywords - rule grammar - doule quotes to file keywords - rule grammar - double quotes

subject correction

Actions
Copy link
 #2

Updated by Victor Julien over 11 years ago

Is that a problem?

Actions
Copy link
 #3

Updated by Peter Manev over 11 years ago

no - it is not a problem at the moment.
I think it is inconsistency though - should we use quotes or not?

Actions
Copy link
 #4

Updated by Victor Julien over 10 years ago

  • Target version set to TBD
Actions
Copy link
 #5

Updated by Andreas Herz over 8 years ago

  • Assignee set to Andreas Herz
Actions
Copy link
 #6

Updated by Victor Julien over 8 years ago

  • Status changed from New to Closed
  • Assignee deleted (Andreas Herz)
  • Target version deleted (TBD)

Won't fix, we can't risk breaking many existing rules.

Actions
Copy link

Also available in: Atom PDF