Project

General

Profile

Actions

Task #5632

closed

Disable swf decompression by default

Added by Todd Mortimer almost 2 years ago. Updated almost 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

SWF decompression currently relies on libhtp's LZMA decompressor. While discussing migration to libhtp-rs it was suggested that LZMA decompression in suricata could just depend on lzma-rs directly instead of having libhtp-rs expose a LZMA decompression interface.

https://github.com/OISF/suricata/pull/7438#discussion_r887130753

While doing that PR, it was suggested that SWF decompression should eventually be removed entirely, since SWF is going away / gone. As a step towards that direction, SWF decompression should be disabled by default.

https://github.com/OISF/suricata/pull/7625#issuecomment-1294813995

So this task is to disable SWF decompression by default.

Actions

Also available in: Atom PDF