diff --git a/VERSION b/VERSION index d863755398..6503b2725a 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -8.1.0-dev.50 +8.1.0-dev.51 diff --git a/scripts/policy/protocols/http/var-extraction-uri.zeek b/scripts/policy/protocols/http/var-extraction-uri.zeek index 776c659530..36054648d0 100644 --- a/scripts/policy/protocols/http/var-extraction-uri.zeek +++ b/scripts/policy/protocols/http/var-extraction-uri.zeek @@ -13,5 +13,9 @@ redef record Info += { event http_request(c: connection, method: string, original_URI: string, unescaped_URI: string, version: string) &priority=2 { - c$http$uri_vars = extract_keys(original_URI, /&/); + local param_parts = split_string1(original_URI, /\?/); + if ( |param_parts| > 1 ) + { + c$http$uri_vars = extract_keys(param_parts[1], /&/); + } } diff --git a/testing/btest/Baseline/scripts.policy.protocols.http.var-extraction-uri/http-reduced.log b/testing/btest/Baseline/scripts.policy.protocols.http.var-extraction-uri/http-reduced.log new file mode 100644 index 0000000000..8535152fac --- /dev/null +++ b/testing/btest/Baseline/scripts.policy.protocols.http.var-extraction-uri/http-reduced.log @@ -0,0 +1,2 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +/response-headers?Content-Type=application/octet-stream; charset=UTF-8&Content-Disposition=attachment; filename="test.json" Content-Type,Content-Disposition diff --git a/testing/btest/scripts/policy/protocols/http/var-extraction-uri.zeek b/testing/btest/scripts/policy/protocols/http/var-extraction-uri.zeek new file mode 100644 index 0000000000..5ae01c44ea --- /dev/null +++ b/testing/btest/scripts/policy/protocols/http/var-extraction-uri.zeek @@ -0,0 +1,5 @@ +# @TEST-EXEC: zeek -r ${TRACES}/http/http-filename.pcap %INPUT +# @TEST-EXEC: zeek-cut uri uri_vars http-reduced.log +# @TEST-EXEC: btest-diff http-reduced.log + +@load policy/protocols/http/var-extraction-uri diff --git a/testing/external/commit-hash.zeek-testing b/testing/external/commit-hash.zeek-testing index 4d12c67ff0..4f76da2292 100644 --- a/testing/external/commit-hash.zeek-testing +++ b/testing/external/commit-hash.zeek-testing @@ -1 +1 @@ -6dafc6fd68d9821f33b7f8f4d7d4d877b5827ae3 +4b4c64d059f8ca4903637f0e00aabb819f3ba5e9 diff --git a/testing/external/commit-hash.zeek-testing-private b/testing/external/commit-hash.zeek-testing-private index f01f56f57a..dd48094462 100644 --- a/testing/external/commit-hash.zeek-testing-private +++ b/testing/external/commit-hash.zeek-testing-private @@ -1 +1 @@ -1edbd3ae959471e8573c9edc0374235727970710 +7eaae517ec96a5218d35a4800bec9df1079b6de6