Suricata

This isn't a bug, it is expected and desired behavior.

The 'http_uri' buffer is a normalized buffer which means that "/../" in the URI (directory traversal) will be normalized to just "/" in the 'http_uri' buffer and remove the preceding directory (if present). For example, if the URI on the wire looked like this:

/foo/bar/../baz/index.html

Then the 'http_uri' normalized buffer would look like this:

/foo/baz/index.html

To match on "/../" in the URI, use the 'http_raw_uri' buffer which isn't normalized and contains what you see on the wire, as you have discovered.

Note that other HTTP URI normalizations like percent decoding are done to the http_uri buffer and apply as well. For example, if the URI on the wire looked like this:

/foo/bar/%2e%2e/baz/index.html

Then the 'http_uri' normalized buffer would look like this:

/foo/baz/index.html

(/foo/bar/%2e%2e/baz/index.html gets normalized to /foo/bar/../baz/index.html and then finally /foo/baz/index.html)

Oooh ,thanks for your splendid explanation! Understood!
Feel free to close this issue, please (I don't get how to do it, sorry)