Project

General

Profile

Feature #7114

Updated by Victor Julien 6 months ago

Thinking about something like: 
 <pre> 
 file.data; from_base64:strict,set_error; decode_base64:strict,set_error; content:"BASE64_ECODE_BUF"; 
 </pre> 
 Not entirely sure what the buffer should be set to. 

 It could be used to make sure base64 at an expected location is valid, so it wouldn't match if it decoded correctly. 
 <pre> 
 file.data; from_base64:strict,set_error; decode_base64:strict,set_error; bsize:0; 
 </pre> 
 Would also need to see how to express this, as the bsize here is useless.

Back