Support \| and valid escape sequences in content matching

parser.go

@@ -36,7 +36,7 @@ var hexRE = regexp.MustCompile(`(?i)(\|(?:\s*[a-f0-9]{2}\s*)+\|)`)
 var escapeRE = regexp.MustCompile(`([()+.'\\])`)
 
 // escapeContent matches escaped special characters.
-var escapeContent = regexp.MustCompile(`\\([\\;":])`)
+var escapeContent = regexp.MustCompile(`\\([\\;":|\[\]+ .])`)
 
 // metaSplitRE matches string in metadata.
 var metaSplitRE = regexp.MustCompile(`,\s*`)
@@ -386,7 +386,7 @@ func containsUnescaped(s string) bool {
 	for _, b := range s {
 		if esc {
 			switch b {
-			case '\\', ';', '"', ':':
+			case '\\', ';', '"', ':', '|', '[', ']', '+', '.', ' ':
 				esc = false
 			default:
 				return true

parser_test.go

@@ -2139,6 +2139,25 @@ func TestParseRule(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "content match with escaped pipe and characters",
+			rule: `alert tcp any any -> any any (msg:"test"; content:"\|test\| \[abc\] \+ \. \ "; sid:1; rev:1;)`,
+			want: &Rule{
+				Action:      "alert",
+				Protocol:    "tcp",
+				Source:      Network{Nets: []string{"any"}, Ports: []string{"any"}},
+				Destination: Network{Nets: []string{"any"}, Ports: []string{"any"}},
+				SID:         1,
+				Revision:    1,
+				Description: "test",
+				Matchers: []orderedMatcher{
+					&Content{
+						DataPosition: pktData,
+						Pattern:      []byte("|test| [abc] + .  "),
+					},
+				},
+			},
+		},
 		// Errors
 		{
 			name:    "invalid action",
@@ -2364,6 +2383,21 @@ func TestContainsUnescaped(t *testing.T) {
 			input: `\\\\\\\\\;`,
 			want:  false,
 		},
+		{
+			name:  "escaped pipe",
+			input: `\|`,
+			want:  false,
+		},
+		{
+			name:  "escaped bracket",
+			input: `\[`,
+			want:  false,
+		},
+		{
+			name:  "escaped plus dot space",
+			input: `\+\.\ `,
+			want:  false,
+		},
 	} {
 		got := containsUnescaped(tt.input)
 		if got != tt.want {