In Suricata 6.0.0 beta 1, I noticed that the url_decode rule keyword is added. And why url_decode supported in transformation while base64_decode implemented in another way? For example, it needs base64_decode combining with base64_data to alert? It seems more reasonable to design the base64_decode in transformation just like url_decode.
Well, I guess base64_decode can support all kinds of buffers instead url_decode is not applied to all buffers yet.