Actions
Feature #8128
openrules/transform: add json_decode transform
Effort:
Difficulty:
Label:
Description
Like url_decode but for "\u003f", and also remove white spaces...
Files
Actions
Added by Philippe Antoine about 2 months ago. Updated 16 days ago.
Description
Like url_decode but for "\u003f", and also remove white spaces...
Files
| backslash-u-json.pcap (1.15 KB) backslash-u-json.pcap | Philippe Antoine, 12/08/2025 09:22 PM |
Could be prototyped using Lua transform.
Pcap courtesy of Ron Bowes after his Suricon talk
Is the idea here to normalize/decode the JSON, but not parse it into a document tree? I remember from the discussion that there are also issues around key ordering.
For me this was about \u decoding + space removal, no key ordering