Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 17:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fixed a bug resulting in over-logging of detected webapps.

Browse source
This commit is contained in:
Seth Hall 2012-01-20 11:22:15 -05:00
parent 8eeb37129a
commit 5b04789ab8
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
scripts/policy/protocols/http/detect-webapps.bro
View file

@ -36,7 +36,8 @@ event signature_match(state: signature_state, msg: string, data: string) &priori
# use that as the new url for the software. # use that as the new url for the software.
# PROBLEM: different version of the same software on the same server with a shared root path # PROBLEM: different version of the same software on the same server with a shared root path
local is_substring = 0; local is_substring = 0;
if ( Software::tracked[c$id$resp_h][si$name]?$url ) if ( Software::tracked[c$id$resp_h][si$name]?$url &&
|si$url| < |Software::tracked[c$id$resp_h][si$name]$url| )
is_substring = strstr(Software::tracked[c$id$resp_h][si$name]$url, si$url); is_substring = strstr(Software::tracked[c$id$resp_h][si$name]$url, si$url);
if ( is_substring == 1 ) if ( is_substring == 1 )