doc: document that that ;, \, " need to be escaped in rules

pull/2428/head
Jason Ish 9 years ago committed by Victor Julien
parent a67c31d4e1
commit 0c6c9784a2

@ -172,6 +172,12 @@ There are specific settings for:
* payloads
* flows
.. note:: The characters ``;`` and ``"`` have special meaning in the
Suricata rule language and must be escaped when used in a
rule option value. For example::
msg:"Message with semicolon\;";
For more information about these settings, you can click on the
following headlines:

@ -26,10 +26,11 @@ It is a convention that msg is always the first keyword of a signature.
Another example of msg in a signature:
.. image:: meta/msg.png
In this example the red, bold-faced part is the msg.
.. note:: The following characters must be escaped inside the msg:
``;`` ``\`` ``"``
Sid (signature id)
------------------

@ -93,6 +93,9 @@ For example::
You see ``content:!”Firefox/3.6.13”;``. This means an alert will be
generated if the the used version of Firefox is not 3.6.13.
.. note:: The following characters must be escaped inside the content:
``;`` ``\`` ``"``
Nocase
------

@ -54,6 +54,9 @@ qualities of pcre as well. These are:
* ``E``: Ignores newline characters at the end of the buffer/payload.
* ``G``: Inverts the greediness.
.. note:: The following characters must be escaped inside the content:
``;`` ``\`` ``"``
Suricata's modifiers
~~~~~~~~~~~~~~~~~~~~

Loading…
Cancel
Save