Project

General

Profile

Actions

Bug #7870

open

rules: signature line not loaded if starts with space

Added by Paul Viel about 1 month ago. Updated 6 days ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

In a signature file, any line that starts with a space is ignored.

This happens due to line 151 in the file detect-engine-loader.c.

However, this does not seem to be the intended behavior, since the comment above states that only comments and empty lines should be skipped.

Actions #1

Updated by Victor Julien about 1 month ago

  • Subject changed from signature line not loaded if starts with space to rules: signature line not loaded if starts with space

That does seem unintentional indeed. However if we change it now for 8.0.1, could this lead to unexpected behavior as well? Suddenly rules loading that the user didn't expect?

Actions #2

Updated by Jason Ish about 1 month ago

  • Affected Versions 7.0.11 added

7 is affected as well. If new 8, I'd suggest fixing. Cause the inverse argument is also true: there could be rules that the user is expected to be loaded that are not.

Actions #3

Updated by Paul Viel about 1 month ago

I'd suggest fixing too, or at least add a warning to tell the user that the line will not be processed

Actions #4

Updated by Jeff Lucovsky 6 days ago

We can modify 9 so rules load unless the line begins with a comment.
For 8, I'd suggest issuing a warning, perhaps at the end of rule loading: "<n> rules skipped -- line starts with whitespace"

Actions

Also available in: Atom PDF