From 6b30890de97f1c58ecda2c60e308e8d167a36bcc Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Wed, 25 Nov 2020 15:20:02 +0100 Subject: [PATCH] doc: http.uri.raw has no spaces as they are in the protocol cf bug #2881 --- doc/userguide/rules/http-keywords.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/doc/userguide/rules/http-keywords.rst b/doc/userguide/rules/http-keywords.rst index 1f8fbdbb80bb..c97fb0a5d2ce 100644 --- a/doc/userguide/rules/http-keywords.rst +++ b/doc/userguide/rules/http-keywords.rst @@ -190,6 +190,12 @@ characters %20 in a uri. This means matching on the uri.raw. The uri.raw and the normalized uri are separate buffers. So, the uri.raw inspects the uri.raw buffer and can not inspect the normalized buffer. +.. note:: uri.raw never has any spaces in it. + With this request line ``GET /uid=0(root) gid=0(root) HTTP/1.1``, + the ``http.uri.raw`` will match ``/uid=0(root)`` + and ``http.protocol`` will match ``gid=0(root) HTTP/1.1`` + Reference: `https://redmine.openinfosecfoundation.org/issues/2881 `_ + Example of the URI in a HTTP request: .. image:: http-keywords/uri1.png