| Subject: | Bug in value check in as_string method |
There is a bug in the Parse::Snort module rule->as_string() function.
The as_string method truncates distance options which have a zero value.
As an example:
The following:
#!/opt/local/bin/perl use Parse::Snort; my $rulestr='alert udp
$EXTERNAL_NET any -> $HOME_NET 138 (msg:"Test"; content:"|11|";
distance:0; metadata:service netbios-dgm; reference:bugtraq,24196;
reference:cve,2007-2446; classtype:protocol-command-decode; sid:13015;
rev:5;)';
my $rule=Parse::Snort->new(); $rule->parse($rulestr); print
$rule->as_string();
------------
Returns the same with the "distance:0;" option truncated to "distance;"
line 398 just needs to use 'defined' where the test of the value is:
diff
<{ $ret .= sprintf( " (%s)", join( " ", map { $_->[1] ?
"$_->[0]:$_->[1];" : "$_->[0];" } @{ $self->get('opts') } )); }
Show quoted text
>>> { $ret .= sprintf( " (%s)", join( " ", map { defined ($_->[1]) ?
"$_->[0]:$_->[1];" : "$_->[0];" } @{ $self->get('opts') } )); }