Merge pull request #2158 in SNORT/snort3 from ~KATHARVE/snort3:script_case to master

Squashed commit of the following:

commit 9993a5e575b71d330a93f0d99e2a9fc60f19890e
Author: Katura Harvey <katharve@cisco.com>
Date:   Mon Apr 13 13:12:32 2020 -0400

    http_inspect: make script tag check case insensitive

diff --git a/src/service_inspectors/http_inspect/http_cutter.cc b/src/service_inspectors/http_inspect/http_cutter.cc
index 5898cb01f06b1b8661138602e71c39faa22188be..9db4f978d7291da3c4b62734c9d2fc7c89f72100 100644 (file)
--- a/src/service_inspectors/http_inspect/http_cutter.cc
+++ b/src/service_inspectors/http_inspect/http_cutter.cc
@@ -805,11 +805,13 @@ bool HttpBodyCutter::dangerous(const uint8_t* data, uint32_t length)
     }
 
     static const uint8_t match_string[] = { '<', 's', 'c', 'r', 'i', 'p', 't' };
+    static const uint8_t match_string_upper[] = { '<', 'S', 'C', 'R', 'I', 'P', 'T' };
     static const uint8_t string_length = sizeof(match_string);
     for (uint32_t k = 0; k < input_length; k++)
     {
         // partial_match is persistent, enabling matches that cross data boundaries
-        if (input_buf[k] == match_string[partial_match])
+        if ((input_buf[k] == match_string[partial_match]) ||
+            (input_buf[k] == match_string_upper[partial_match]))
         {
             if (++partial_match == string_length)
             {