Pull request #3427: docs: JS Normalizer: track constructed objects

Merge in SNORT/snort3 from ~DKYRYLOV/snort3:doc_js_class_track to master

Squashed commit of the following:

commit 94a5709811b971bdec31035b9970866143914e07
Author: dkyrylov <dkyrylov@cisco.com>
Date:   Wed May 18 14:20:14 2022 +0300

    doc: add class track description to user doc

diff --git a/doc/user/http_inspect.txt b/doc/user/http_inspect.txt
index 3637f5c0d51f942ef99f7ac76de69a85d8adf2d9..b09c4821934eb934a7cbe1aef7c3cb361e9203e6 100755 (executable)
--- a/doc/user/http_inspect.txt
+++ b/doc/user/http_inspect.txt
@@ -279,6 +279,15 @@ For example:
     var a = console.log
     a("hello") // will be substituted to 'console.log("hello")'
 
+For class names and constructors in the list, when the class is used with the
+keyword 'new', created object will be tracked, and its properties will be kept intact.
+Identifier of the object itself, however, will be brought to unified form.
+
+For example:
+
+    var o = new Array() // normalized to 'var var_0000=new Array()'
+    o.push(10) // normalized to 'var_0000.push(10)'
+
 The default list of ignore-identifiers is present in "snort_defaults.lua".
 
 Unescape function names should remain intact in the output. They ought to be