Bug #7870
openrules: signature line not loaded if starts with space
Description
In a signature file, any line that starts with a space is ignored.
This happens due to line 151 in the file detect-engine-loader.c.
However, this does not seem to be the intended behavior, since the comment above states that only comments and empty lines should be skipped.
Updated by Victor Julien 2 months ago
- Subject changed from signature line not loaded if starts with space to rules: signature line not loaded if starts with space
That does seem unintentional indeed. However if we change it now for 8.0.1, could this lead to unexpected behavior as well? Suddenly rules loading that the user didn't expect?
Updated by Jason Ish about 2 months ago
- Affected Versions 7.0.11 added
7 is affected as well. If new 8, I'd suggest fixing. Cause the inverse argument is also true: there could be rules that the user is expected to be loaded that are not.
Updated by Paul Viel about 2 months ago
I'd suggest fixing too, or at least add a warning to tell the user that the line will not be processed
Updated by Jeff Lucovsky 28 days ago
We can modify 9 so rules load unless the line begins with a comment.
For 8, I'd suggest issuing a warning, perhaps at the end of rule loading: "<n> rules skipped -- line starts with whitespace"