@@ -256,6 +256,7 @@ void help(void)

     mprintf("    --phishing-cloak[=yes/no(*)]         Always block cloaked URLs (phishing module)\n");

     mprintf("    --partition-intersection[=yes/no(*)] Detect partition intersections in raw disk images using heuristics.\n");

     mprintf("    --algorithmic-detection[=yes(*)/no]  Algorithmic detection\n");

+    mprintf("    --normalize[=yes(*)/no]              Normalize html, script, and text files. Use normalize=no for yara compatibility.\n");

     mprintf("    --scan-pe[=yes(*)/no]                Scan PE files\n");

     mprintf("    --scan-elf[=yes(*)/no]               Scan ELF files\n");

     mprintf("    --scan-ole2[=yes(*)/no]              Scan OLE2 containers\n");

@@ -1080,7 +1080,7 @@ int scanmanager(const struct optstruct *opts)

     if(optget(opts, "scan-swf")->enabled)

         options |= CL_SCAN_SWF;

-    if(optget(opts, "scan-html")->enabled)

+    if(optget(opts, "scan-html")->enabled && optget(opts, "normalize")->enabled)

         options |= CL_SCAN_HTML;

     if(optget(opts, "scan-mail")->enabled)

@@ -149,6 +149,9 @@ Detect partition intersections in raw disk images using heuristics.

 .TP

 \fB\-\-algorithmic\-detection[=yes(*)/no]\fR

 In some cases (eg. complex malware, exploits in graphic files, and others), ClamAV uses special algorithms to provide accurate detection. This option can be used to control the algorithmic detection.

+.TP

+\fB\-\-normalize[=yes(*)/no]\fR

+Normalize (compress whitespace, downcase, etc.) html, script, and text files. Use normalize=no for yara compatibility. 

 .TP 

 \fB\-\-scan\-pe[=yes(*)/no]\fR

 PE stands for Portable Executable \- it's an executable file format used in all 32\-bit versions of Windows operating systems. By default ClamAV performs deeper analysis of executable files and attempts to decompress popular executable packers such as UPX, Petite, and FSG. If you turn off this option, the original files will still be scanned but without additional processing.

@@ -3278,7 +3278,7 @@ static int magic_scandesc(cli_ctx *ctx, cli_file_t type)

 	case CL_TYPE_TEXT_UTF16LE:

 	case CL_TYPE_TEXT_UTF8:

 	    perf_nested_start(ctx, PERFT_SCRIPT, PERFT_SCAN);

-	    if((DCONF_DOC & DOC_CONF_SCRIPT) && dettype != CL_TYPE_HTML && ret != CL_VIRUS)

+	    if((DCONF_DOC & DOC_CONF_SCRIPT) && dettype != CL_TYPE_HTML && (ret != CL_VIRUS || SCAN_ALL) && SCAN_HTML)

 	        ret = cli_scanscript(ctx);

 	    if(SCAN_MAIL && (DCONF_MAIL & MAIL_CONF_MBOX) && ret != CL_VIRUS && (ctx->container_type == CL_TYPE_MAIL || dettype == CL_TYPE_MAIL)) {

 		ret = cli_fmap_scandesc(ctx, CL_TYPE_MAIL, 0, NULL, AC_SCAN_VIR, NULL, NULL);

@@ -87,6 +87,7 @@ const struct clam_option __clam_options[] = {

     { NULL, "fdpass", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMDSCAN, "", "" },

     { NULL, "stream", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMDSCAN, "", "" },

     { NULL, "allmatch", 'z', CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMSCAN | OPT_CLAMDSCAN, "", "" },

+    { NULL, "normalize", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMSCAN, "Perform HTML, script, and text normalization", "" },

     { NULL, "database", 'd', CLOPT_TYPE_STRING, NULL, -1, DATADIR, FLAG_REQUIRED | FLAG_MULTIPLE, OPT_CLAMSCAN, "", "" }, /* merge it with DatabaseDirectory (and fix conflict with --datadir */

     { NULL, "recursive", 'r', CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMSCAN, "", "" },

     { NULL, "gen-mdb", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMSCAN, "Always generate MDB entries for PE sections", "" },