Project

General

Profile

Actions
Copy link

Bug #7870

open

rules: signature line not loaded if starts with space

Added by Paul Viel 21 days ago. Updated 15 days ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Affected Versions:
7.0.11, 8.0.0
Effort:
Difficulty:
Label:

Description

In a signature file, any line that starts with a space is ignored.

This happens due to line 151 in the file detect-engine-loader.c.

However, this does not seem to be the intended behavior, since the comment above states that only comments and empty lines should be skipped.

Actions
Copy link
 #1

Updated by Victor Julien 20 days ago

  • Subject changed from signature line not loaded if starts with space to rules: signature line not loaded if starts with space

That does seem unintentional indeed. However if we change it now for 8.0.1, could this lead to unexpected behavior as well? Suddenly rules loading that the user didn't expect?

Actions
Copy link
 #2

Updated by Jason Ish 15 days ago

  • Affected Versions 7.0.11 added

7 is affected as well. If new 8, I'd suggest fixing. Cause the inverse argument is also true: there could be rules that the user is expected to be loaded that are not.

Actions
Copy link
 #3

Updated by Paul Viel 15 days ago

I'd suggest fixing too, or at least add a warning to tell the user that the line will not be processed

Actions
Copy link

Also available in: Atom PDF