Pull request #3424: JS Normalizer: check content decoding

Merge in SNORT/snort3 from ~OSHUMEIK/snort3:js_content_encoding to master

Squashed commit of the following:

commit 4fc6db8e507415d6feb50ae8691f0daba6492b8d
Author: Oleksii Shumeiko <oshumeik@cisco.com>
Date:   Sun May 15 23:24:24 2022 +0300

    http_inspect: avoid sending compressed data to JS normalizer

diff --git a/src/service_inspectors/http_inspect/http_msg_body.cc b/src/service_inspectors/http_inspect/http_msg_body.cc
index 3aa4b02691d3d93e8665046c8cfb4cb2ffaf0511..c45690bce871bf6b69dcc9de6e02bf263eb5e24c 100644 (file)
--- a/src/service_inspectors/http_inspect/http_msg_body.cc
+++ b/src/service_inspectors/http_inspect/http_msg_body.cc
@@ -396,6 +396,9 @@ void HttpMsgBody::do_enhanced_js_normalization(const Field& input, Field& output
     auto http_header = get_header(source_id);
     auto normalizer = params->js_norm_param.js_norm;
 
+    if ((*infractions & INF_UNKNOWN_ENCODING) or (*infractions & INF_UNSUPPORTED_ENCODING))
+        return;
+
     if (session_data->is_pdu_missed())
     {
         *infractions += INF_JS_PDU_MISS;