[Bro] HTTP Content Disposition

[Seth Hall]

> On Oct 16, 2015, at 9:22 AM, Albert Zaharovits <albert.zaharovits at gmail.com> wrote:
> 
> I thought it might be a bug too…
> I already started browsing the source/debugging, but no success so far…
> Any leads? Where should I focus my attention?
> I would like to submit a pull request!

I would focus on the interplay where the c$http$current_entity field is set.  I’m not exactly sure which script it will be in, but you should be able to find all of the places where that’s set pretty easily.

Looking forward to a fix! :)

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/