Project

General

Profile

Actions
Copy link

Bug #7870

open

rules: signature line not loaded if starts with space

Added by Paul Viel 3 months ago. Updated about 2 months ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Affected Versions:
7.0.11, 8.0.0
Effort:
Difficulty:
Label:

Description

In a signature file, any line that starts with a space is ignored.

This happens due to line 151 in the file detect-engine-loader.c.

However, this does not seem to be the intended behavior, since the comment above states that only comments and empty lines should be skipped.

Actions
Copy link
 #1

Updated by Victor Julien 3 months ago

  • Subject changed from signature line not loaded if starts with space to rules: signature line not loaded if starts with space

That does seem unintentional indeed. However if we change it now for 8.0.1, could this lead to unexpected behavior as well? Suddenly rules loading that the user didn't expect?

Actions
Copy link
 #2

Updated by Jason Ish 3 months ago

  • Affected Versions 7.0.11 added

7 is affected as well. If new 8, I'd suggest fixing. Cause the inverse argument is also true: there could be rules that the user is expected to be loaded that are not.

Actions
Copy link
 #3

Updated by Paul Viel 3 months ago

I'd suggest fixing too, or at least add a warning to tell the user that the line will not be processed

Actions
Copy link
 #4

Updated by Jeff Lucovsky about 2 months ago

We can modify 9 so rules load unless the line begins with a comment.
For 8, I'd suggest issuing a warning, perhaps at the end of rule loading: "<n> rules skipped -- line starts with whitespace"

Actions
Copy link

Also available in: Atom PDF