search

jasonish / py-idstools

idstools: Snort and Suricata Rule and Event Utilities in Python (Including a Rule Update Tool)
Other
277 stars 85 forks source link

Wrong parsing of pcre and possibly others #97

Open vpiserchia opened 11 months ago

vpiserchia commented 11 months ago

I've just found a possible problems in the options parsing function find_opt_end

For example when in a quoted options (like the PCRE ones, but also others ) it is possible to find a semicolon char and break the parsing.

To explain, the following returns a wrong option list:

pcre:"/[^\x15][^I?>(i/.7*)+96][ -\',-013-68;-=@-GJ-MOP-_`hk-op-tv-\x7f]{1,14}\x15/R";