csirtgadgets/iodef-pb-simple-perl — pull request #11 by jeffmurphy (2014-04-16 17:49:43+00:00)
Title: escape some addt chars to keep snort happy

basically:

1) escape reserved chars for snorts msg: field (current code only escapes content: field)
2) convert pipes to |7c| because snort doesnt like \| and if you have two pipes in CIF it will make snort cranky

so

msg: "blah & blah"
becomes
msg: "blah &\; blah"

and

content: "hi || mom!"
becomes
content: "hi |7c||7c| mom!"

with this patch