Bug #7870
open
rules: signature line not loaded if starts with space
Added by Paul Viel 21 days ago.
Updated 15 days ago.
Description
In a signature file, any line that starts with a space is ignored.
This happens due to line 151 in the file detect-engine-loader.c.
However, this does not seem to be the intended behavior, since the comment above states that only comments and empty lines should be skipped.
- Subject changed from signature line not loaded if starts with space to rules: signature line not loaded if starts with space
That does seem unintentional indeed. However if we change it now for 8.0.1, could this lead to unexpected behavior as well? Suddenly rules loading that the user didn't expect?
- Affected Versions 7.0.11 added
7 is affected as well. If new 8, I'd suggest fixing. Cause the inverse argument is also true: there could be rules that the user is expected to be loaded that are not.
I'd suggest fixing too, or at least add a warning to tell the user that the line will not be processed
Also available in: Atom
PDF