From dba73f53676594dfcbf2c617aff3598b65c14316 Mon Sep 17 00:00:00 2001
From: Felipe Zimmerle <fcosta@trustwave.com>
Date: Tue, 9 Oct 2018 22:04:20 -0300
Subject: [PATCH] Using values after transformation at MATCHED_VARS

---
 src/rule.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/rule.cc b/src/rule.cc
index 702367b0..598665a2 100644
--- a/src/rule.cc
+++ b/src/rule.cc
@@ -768,7 +768,7 @@ bool Rule::evaluate(Transaction *trans,
                         ruleMessage->m_reference.append(i->toText());
                     }
                     ruleMessage->m_reference.append(*valueTemp.second);
-                    updateMatchedVars(trans, key, value);
+                    updateMatchedVars(trans, key, valueAfterTrans);
                     executeActionsIndependentOfChainedRuleResult(trans,
                         &containsBlock, ruleMessage);
                     globalRet = true;