inliniac/suricata — pull request #620 by inliniac (2013-11-12 09:38:55+00:00)
Title: http: don't decode + to space by default

Libhtp decodes the + character in the query string to a space by default.
Suricata rules (e.g. etpro sid 2806767) are expecting to see the space in
the http_uri buffer.

Added an option per htp config to reenable this default behavior:

query-plusspace-decode: yes

Bug #1035.

https://redmine.openinfosecfoundation.org/issues/1035
https://buildbot.suricata-ids.org/builders/inliniac/builds/44