From: Mike Stepanek (mstepane) <mstepane@cisco.com>
Date: Wed, 15 Apr 2020 12:59:01 +0000 (+0000)
Subject: Merge pull request #2158 in SNORT/snort3 from ~KATHARVE/snort3:script_case to master
X-Git-Tag: 3.0.1-2~16
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a1dce10adb334de76200a61262a95dd4bd024894;p=thirdparty%2Fsnort3.git

Merge pull request #2158 in SNORT/snort3 from ~KATHARVE/snort3:script_case to master

Squashed commit of the following:

commit 9993a5e575b71d330a93f0d99e2a9fc60f19890e
Author: Katura Harvey <katharve@cisco.com>
Date:   Mon Apr 13 13:12:32 2020 -0400

    http_inspect: make script tag check case insensitive
---

diff --git a/src/service_inspectors/http_inspect/http_cutter.cc b/src/service_inspectors/http_inspect/http_cutter.cc
index 5898cb01f..9db4f978d 100644
--- a/src/service_inspectors/http_inspect/http_cutter.cc
+++ b/src/service_inspectors/http_inspect/http_cutter.cc
@@ -805,11 +805,13 @@ bool HttpBodyCutter::dangerous(const uint8_t* data, uint32_t length)
     }
 
     static const uint8_t match_string[] = { '<', 's', 'c', 'r', 'i', 'p', 't' };
+    static const uint8_t match_string_upper[] = { '<', 'S', 'C', 'R', 'I', 'P', 'T' };
     static const uint8_t string_length = sizeof(match_string);
     for (uint32_t k = 0; k < input_length; k++)
     {
         // partial_match is persistent, enabling matches that cross data boundaries
-        if (input_buf[k] == match_string[partial_match])
+        if ((input_buf[k] == match_string[partial_match]) ||
+            (input_buf[k] == match_string_upper[partial_match]))
         {
             if (++partial_match == string_length)
             {