Fix extra spaces confusing content and uricontent.

src/detect-content.c

@@ -585,6 +585,8 @@ DetectContentData *DetectContentParse (char *contentstr)
     char *str = NULL;
     char *temp = NULL;
     uint16_t len;
+    uint16_t pos = 0;
+    uint16_t slen = 0;
 
     if ((temp = strdup(contentstr)) == NULL)
         goto error;
@@ -601,19 +603,25 @@ DetectContentData *DetectContentParse (char *contentstr)
     }
     memset(cd, 0, sizeof(DetectContentData));
 
-    if (temp[0] == '!') {
+    /* skip the first spaces */
+    slen = strlen(temp);
+    while (pos < slen && isspace(temp[pos])) {
+        pos++;
+    };
+
+    if (temp[pos] == '!') {
         free(temp);
-        if ( (temp = strdup(contentstr + 1)) == NULL)
+        if ((temp = strdup(contentstr + pos + 1)) == NULL)
             goto error;
         cd->negated = 1;
     }
 
-    if (temp[0] == '\"' && temp[strlen(temp)-1] == '\"') {
-        if ( (str = strdup(temp + 1)) == NULL)
+    if (temp[pos] == '\"' && temp[strlen(temp)-1] == '\"') {
+        if ((str = strdup(temp + pos + 1)) == NULL)
             goto error;
-        str[strlen(temp) - 2] = '\0';
+        str[strlen(temp) - pos - 2] = '\0';
     } else {
-        if ( (str = strdup(temp)) == NULL)
+        if ((str = strdup(temp + pos)) == NULL)
             goto error;
     }
 
@@ -2665,6 +2673,45 @@ int DetectContentParseNegTest13(void) {
     return result;
 }
 
+int DetectContentParseNegTest14(void) {
+    int result = 0;
+    DetectContentData *cd = NULL;
+    char *teststring = "  \"!boo\"";
+
+    cd = DetectContentParse(teststring);
+    if (cd != NULL) {
+        result = (cd->negated == 1);
+        DetectContentFree(cd);
+    }
+    return result;
+}
+
+int DetectContentParseNegTest15(void) {
+    int result = 0;
+    DetectContentData *cd = NULL;
+    char *teststring = "  !boo";
+
+    cd = DetectContentParse(teststring);
+    if (cd != NULL) {
+        result = (cd->negated == 1);
+        DetectContentFree(cd);
+    }
+    return result;
+}
+
+int DetectContentParseNegTest16(void) {
+    int result = 0;
+    DetectContentData *cd = NULL;
+    char *teststring = "  boo";
+
+    cd = DetectContentParse(teststring);
+    if (cd != NULL) {
+        result = (cd->content_len == 3 && memcmp(cd->content,"boo",3) == 0);
+        DetectContentFree(cd);
+    }
+    return result;
+}
+
 static int SigTestPositiveTestContent(char *rule, uint8_t *buf)
 {
     uint16_t buflen = strlen((char *)buf);
@@ -3037,6 +3084,9 @@ void DetectContentRegisterTests(void)
     UtRegisterTest("DetectContentParseTest11", DetectContentParseNegTest11, 1);
     UtRegisterTest("DetectContentParseTest12", DetectContentParseNegTest12, 1);
     UtRegisterTest("DetectContentParseTest13", DetectContentParseNegTest13, 1);
+    UtRegisterTest("DetectContentParseTest14", DetectContentParseNegTest14, 1);
+    UtRegisterTest("DetectContentParseTest15", DetectContentParseNegTest15, 1);
+    UtRegisterTest("DetectContentParseTest16", DetectContentParseNegTest16, 1);
 
     UtRegisterTest("DetectContentChunkTestB2G01 l=32", DetectContentChunkTestB2G01, 1);
     UtRegisterTest("DetectContentChunkTestB3G01 l=32", DetectContentChunkTestB3G01, 1);

src/detect-uricontent.c

@@ -209,19 +209,20 @@ int DetectUricontentSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, c
 {
     DetectUricontentData *cd = NULL;
     SigMatch *sm = NULL;
-    char *str = contentstr;
+    char *temp = NULL;
+    char *str = NULL;
     char dubbed = 0;
     uint16_t len = 0;
+    uint16_t pos = 0;
+    uint16_t slen = 0;
 
-    if (contentstr[0] == '\"' && contentstr[strlen(contentstr)-1] == '\"') {
-        str = strdup(contentstr+1);
-        str[strlen(contentstr)-2] = '\0';
-        dubbed = 1;
-    }
+    if ((temp = strdup(contentstr)) == NULL)
+        goto error;
 
-    len = strlen(str);
-    if (len == 0)
+    if (strlen(temp) == 0) {
+        if (temp) free(temp);
         return -1;
+    }
 
     cd = malloc(sizeof(DetectUricontentData));
     if (cd == NULL) {
@@ -230,7 +231,30 @@ int DetectUricontentSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, c
     }
     memset(cd,0,sizeof(DetectUricontentData));
 
-    //printf("DetectUricontentSetup: \"%s\", len %" PRIu32 "\n", str, len);
+    /* skip the first spaces */
+    slen = strlen(temp);
+    while (pos < slen && isspace(temp[pos])) {
+        pos++;
+    };
+
+    if (temp[pos] == '!') {
+        SCLogError(SC_ERR_NO_URICONTENT_NEGATION, "uricontent negation is not supported at this time. See bug #31.");
+        goto error;
+    }
+
+    if (temp[pos] == '\"' && temp[strlen(temp)-1] == '\"') {
+        if ((str = strdup(temp + pos + 1)) == NULL)
+            goto error;
+        str[strlen(temp) - pos - 2] = '\0';
+    } else {
+        if ((str = strdup(temp + pos)) == NULL)
+            goto error;
+    }
+
+    free(temp);
+    len = strlen(str);
+
+    printf("DetectUricontentSetup: \"%s\", len %" PRIu32 "\n", str, len);
     char converted = 0;
 
     {

src/util-error.c

@@ -68,6 +68,7 @@ const char * SCErrorToString(SCError err)
         CASE_CODE (SC_ERR_FLAGS_MODIFIER);
         CASE_CODE (SC_ERR_DISTANCE_MISSING_CONTENT);
         CASE_CODE (SC_ERR_WITHIN_MISSING_CONTENT);
+        CASE_CODE (SC_ERR_NO_URICONTENT_NEGATION);
         default:
             return "UNKNOWN_ERROR";
     }

src/util-error.h

@@ -79,6 +79,7 @@ typedef enum {
     SC_ERR_FLAGS_MODIFIER,
     SC_ERR_DISTANCE_MISSING_CONTENT,
     SC_ERR_WITHIN_MISSING_CONTENT,
+    SC_ERR_NO_URICONTENT_NEGATION,
 } SCError;
 
 const char *SCErrorToString(SCError);