From 7516cd345bfd7afe358711d0685e31c27e1b1392 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <contact@catenacyber.fr>
Date: Tue, 2 Apr 2019 12:23:45 +0200
Subject: [PATCH] Adds a test case for uri with space in it

---
 tests/http-uri-spaces/README.md  |  11 +++++++++++
 tests/http-uri-spaces/input.pcap | Bin 0 -> 1888 bytes
 tests/http-uri-spaces/test.rules |   1 +
 tests/http-uri-spaces/test.yaml  |  13 +++++++++++++
 4 files changed, 25 insertions(+)
 create mode 100644 tests/http-uri-spaces/README.md
 create mode 100644 tests/http-uri-spaces/input.pcap
 create mode 100644 tests/http-uri-spaces/test.rules
 create mode 100644 tests/http-uri-spaces/test.yaml

diff --git a/tests/http-uri-spaces/README.md b/tests/http-uri-spaces/README.md
new file mode 100644
index 000000000..8d5b38978
--- /dev/null
+++ b/tests/http-uri-spaces/README.md
@@ -0,0 +1,11 @@
+# Description
+
+Test http URI detection with spaces in it
+
+# PCAP
+
+The pcap comes from the idea in
+https://redmine.openinfosecfoundation.org/issues/2881
+You can reproduce a similar behavior with running a server and curl against it
+`python3 -m http.server`
+`curl "127.0.0.1:8000/uri afterspace"`
diff --git a/tests/http-uri-spaces/input.pcap b/tests/http-uri-spaces/input.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..aba13b88bedf289a0e1abda99dbdf6bb896fa81e
GIT binary patch
literal 1888
zc-ozm&rj1}7{|K-#xyPwe<Z{UFAattaedn{+!$qy{Ro(V0_!A36Rq9Lwm90_zT4Qr
z=)ph01Mz5L{0E45;AjFjICvlt!X1y^J%CTw;f8i(*zQTX=jro#pZEKI)4i?FAH7T`
z)3}`H$DvP8e79L93D0(TAyNzzvwyKm4D*^{Ja!x$_Qq})M-T0ub??c^aS-0^oZR<x
zbaZ(<m)YyTUTxK=UWd8R2D3MIa9G~&I|A;~`Zaf^9jDA^zzhQ`++YS<%((>IA8)RT
z-;W0&*~GFrFWTVLXZvBZT5&!AXASz-8k~3M&eH>&w`V!iDH-9CSwPA%C8lL4DnT={
zJdZ_Q^szI#MI%TIgm?jNF%lL8!N+DSV*00YM1z`IGK)CGj|O=tOsOg{AUTYOeXNhQ
zXWYElUN>N`dv1IEIlwYEJxnbej;H%vPLH^E(sh<o-<N=bf`H;m7MbK_iC7d_RgEgE
zXmH>>H3o)!Y?_#5Vn$H9uwoQRts?Mu(R`KWbq$a3AwJ+^lL{pfB$vn?Bm~fuVWNN_
zjv-Nq1cZnvqUkx=$0l@5BPuQE8faM5EmBKS(9|zi4d|z2mEt^IDUPdo#k2^WDA8qq
zxbfO7(Q-5&L8Ic>sn}Nr+cxM%d7s+`vA?;AeG52~0I<X1c*otv=C)78W`wgGsW15;
zAwQZ=fq-+fXg(94y_Z0oALFHw1jb1@=@h^?BF3rv9E<7~m#5T-U|gwG_{s>cn>j2m
z)}#nxi<$+M@>!bYqO4@+qP0FLPn2x*4?<cYR6#b!4@X=mPjJoRa!7UlO>iw#=9*Bn
zK#L@rGELnC!&ru{SwzB4)>#`j7MGsu*=kdBUi_yMQjNM%FROYM&K!IxVdG4Bj#!qG
zgW7-imH!*oSPPL=qo`<#V?etlO%+<Q`1n-v>0)XjlS<3T@3traN}5$N4Bez8i$LhS
zo^7loVMhT8JBMT2Y3M?>?B4-fes!~De6ZbbN&imGmfh~(lFY^C*=;q?`-^hA-8q}>
N?`s!WU);WtzX2#__~ZZp

literal 0
Hc-jL100001

diff --git a/tests/http-uri-spaces/test.rules b/tests/http-uri-spaces/test.rules
new file mode 100644
index 000000000..92cd3582f
--- /dev/null
+++ b/tests/http-uri-spaces/test.rules
@@ -0,0 +1 @@
+alert http any any -> any any (msg:"uri with space and after"; flow:established,to_server; content:" afterspace"; http_uri; sid:1; rev:1;)
diff --git a/tests/http-uri-spaces/test.yaml b/tests/http-uri-spaces/test.yaml
new file mode 100644
index 000000000..5c45c0e2a
--- /dev/null
+++ b/tests/http-uri-spaces/test.yaml
@@ -0,0 +1,13 @@
+requires:
+  min-version: 8.0.0
+
+# disables checksum verification
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
-- 
2.47.2