evilsocket / evilsocket/opensnitch
[Bug Report] Executable / Command line rules using regular expression are saved in lowercase
- Dominant language
- Python
- Stars
- 14.1k
- Forks
- 665
- PR merge metrics
- No merged PRs in 30d
Description
### Describe the bug:
Process path and process executable that are saved using the UI are saved as lower case when regular expression is checked even if the content of the input fields contains uppercase characters.
This makes it so that any executable that has an uppercase character in the fullpath are not matched.
The following path: `/path/to/executable/[a-zA-Z0-9]+/MyExecutable` is saved as the following rule, notice `operator.data` is all lower case (reproduction steps listed further down below):
```json
{
"created": "2025-12-26T17:55:34+01:00",
"updated": "2025-12-26T17:55:34+01:00",
"name": "my-regex-rule",
"description": "",
"action": "deny",
"duration": "always",
"operator": {
"operand": "process.path",
"data": "/path/to/executable/[a-za-z0-9]+/myexecutable",
"type": "regexp",
"list": [],
"sensitive": false
},
"enabled": true,
"precedence": false,
"nolog": false
}
```
Include the following information:
- OpenSnitch version: 1.7.2
- OS: NixOS
- OS version: 26.05 (Yarara)
- Window Manager: Hyprland
- Kernel version: `Linux workstation 6.18.0 #1-NixOS SMP PREEMPT_DYNAMIC Sun Nov 30 22:42:10 UTC 2025 x86_64 GNU/Linux`
### To Reproduce:
Steps to reproduce the behavior:
1. Create new rule, example: `my-regex-rule`
2. Go to Applications tab
3. Check both **From this executable** and **is regular expression**
4. Add the following path `/path/to/executable/[a-zA-Z0-9]+/MyExecutable`
5. Save
6. Open `/etc/opensnitchd/rules/my-regex-rule.json` and observe the supplied path is now lower case.
### Post error logs:
### Expected behavior (optional):
Expected behavior is for the paths to be saved in the same case that was supplied in the UI.
Currently the rules cannot handle any upper case characters.
### Screenshots:
### Additional context:
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.