Suricata » Suricata-Update

There is this code in suricata/update/rule.py:

def parse_fileobj(fileobj, group=None):
...
for line in fileobj:
try:
if type(line) == type(b""):
line = line.decode()
except:
pass
if line.rstrip().endswith("\\"):
buf = "%s%s " % (buf, line.rstrip()[0:-1])
continue

It's called by this code:

rules += rule_mod.parse_fileobj(io.BytesIO(entry.content), entry.filename)

So, it takes some kind of entry.content and passes it to the function as bytes.

In the function, it tries the conversion from bytes to string:

try:
            if type(line) == type(b""):
                line = line.decode()
        except:
            pass

But if it fails, it simply gives up and continues: now it fails later on because the line is a byte-string, not a unicode-string.

That bare `except` is very poor style, and hides what the real bug is.

I don't know what content caused it to fail, but likely a better line would have been:

line = line.decode('utf-8', 'replace')

This code will not fail in the case of UnicodeDecodeError()s.

Original problem:

Traceback (most recent call last):
File "/usr/bin/suricata-update", line 36, in <module>
sys.exit(main.main())
File "/usr/lib/suricata/python/suricata/update/main.py", line 1413, in main
sys.exit(_main())
File "/usr/lib/suricata/python/suricata/update/main.py", line 1259, in _main
rules += rule_mod.parse_fileobj(io.BytesIO(entry.content), entry.filename)
File "/usr/lib/suricata/python/suricata/update/rule.py", line 322, in parse_fileobj
if line.rstrip().endswith("\\"):
TypeError: endswith first arg must be bytes or a tuple of bytes, not str