gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

expr_plus表的district字段支持转义。

Browse Source
This commit is contained in:
zhengchao
2018-02-26 18:42:13 +08:00
parent e863c04f8c
commit 93cb64e46f
3 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/entry/Maat_rule.cpp
View File

@@ -30,7 +30,7 @@
#include "stream_fuzzy_hash.h"
#include "gram_index_engine.h"
int MAAT_FRAME_VERSION_2_1_20180209=1;
int MAAT_FRAME_VERSION_2_1_20180226=1;
const char* CHARSET_STRING[]={"NONE","gbk","big5","unicode","utf8","bin",
"unicode_ascii_esc","unicode_ascii_aligned","unicode_ncr_dec","unicode_ncr_hex","url_encode_gb2312","url_encode_utf8",""};
@@ -1659,6 +1659,7 @@ int add_expr_rule(struct _Maat_table_info_t* table,struct db_str_rule_t* db_rule
if(table->table_type==TABLE_TYPE_EXPR_PLUS)
{
assert(strlen(db_rule->district)>0);
str_unescape(db_rule->district);
district_id=get_district_id(scanner, db_rule->district);
}
group_rule=(struct _Maat_group_inner_t*)HASH_fetch_by_id(scanner->group_hash, db_rule->group_id);

2
test/maat_json.json
View File

@@ -205,7 +205,7 @@
"table_name": "HTTP_REGION",
"table_type": "expr_plus",
"table_content": {
"district": "URL",
"district": "HTTP\\bURL",
"keywords": "abckkk&123",
"expr_type": "and",
"match_method": "sub",

6
test/maat_test.cpp
View File

@@ -424,7 +424,7 @@ int test_expr_plus(Maat_feather_t feather,const char* table_name,scan_status_t*
int table_id=0;
struct Maat_rule_t result[4];
int found_pos[4];
const char* region_name="URL";
const char* region_name="HTTP URL";
const char* scan_data="http://www.cyberessays.com/search_results.php?action=search&query=yulingjing,abckkk,1234567";
table_id=Maat_table_register(feather,table_name);
if(table_id==-1)
@@ -453,6 +453,10 @@ int test_expr_plus(Maat_feather_t feather,const char* table_name,scan_status_t*
{
printf("Hit expr_plus rule %d.\n",result[0].config_id);
}
else
{
printf("Test expr_plus failed.\n");
}
return ret;
}