Actions
Feature #7313
opentransforms: have option on how to handle failure
Effort:
Difficulty:
Label:
Description
Tansforms like base64, pcrexform or urldecode may somehow fail.
Current default is to passthrough
But we could have an option to these keywords to behave differently like return a NULL or 0-length buffer instead of the original one.
Updated by Philippe Antoine 5 months ago
Passthorugh may be a good idea sometimes like dns.query; pcrexform:"\.([^\.]+\.[^\.]+)$"; to extract the top domain if it is a subdomain or just passthrough if it is not a subdomain
Updated by Philippe Antoine 3 days ago
- Assignee changed from OISF Dev to Jeff Lucovsky
Jeff, you have been working on this for base64, so assigning to you
Updated by Philippe Antoine 3 days ago
- Related to Feature #7114: from_base64: allow matching on decode error added
Actions