Feature #7313
open
transforms: have option on how to handle failure
Added by Philippe Antoine 5 months ago.
Updated 5 days ago.
Description
Tansforms like base64, pcrexform or urldecode may somehow fail.
Current default is to passthrough
But we could have an option to these keywords to behave differently like return a NULL or 0-length buffer instead of the original one.
Related issues
1 (1 open — 0 closed)
Passthorugh may be a good idea sometimes like dns.query; pcrexform:"\.([^\.]+\.[^\.]+)$"; to extract the top domain if it is a subdomain or just passthrough if it is not a subdomain
- Assignee changed from OISF Dev to Jeff Lucovsky
Jeff, you have been working on this for base64, so assigning to you
- Related to Feature #7114: from_base64: allow matching on decode error added
Also available in: Atom
PDF