From 74c553c72e19a528cc88ce70239b6c4007e33cb9 Mon Sep 17 00:00:00 2001
From: progmboy <progmboy@gmail.com>
Date: Tue, 27 Jun 2023 19:25:32 +0800
Subject: [PATCH] fix http AUTHORIZATION base64 decode failed

---
 scripts/base/protocols/http/main.zeek | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/base/protocols/http/main.zeek b/scripts/base/protocols/http/main.zeek
index f54216b0dd..e0f0cdc0a0 100644
--- a/scripts/base/protocols/http/main.zeek
+++ b/scripts/base/protocols/http/main.zeek
@@ -290,7 +290,7 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
 			{
 			if ( /^[bB][aA][sS][iI][cC] / in value )
 				{
-				local userpass = decode_base64_conn(c$id, sub(value, /[bB][aA][sS][iI][cC][[:blank:]]/, ""));
+				local userpass = decode_base64_conn(c$id, sub(value, /[bB][aA][sS][iI][cC][[:blank:]]+/, ""));
 				local up = split_string(userpass, /:/);
 				if ( |up| >= 2 )
 					{