Fix incorrect logtype encoding by properly escaping variable placeholder characters (fixes #163). #162
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…; Deduplicate logtype constant escaping method; Replace all instances of variable delimiter with variable placeholder.
Co-authored-by: Lin Zhihao <[email protected]>
…he dictionary entry. Add unittests
kirkrodrigues
requested changes
Nov 29, 2023
There was a problem hiding this comment.
We also need to update the logtype query generation in ffi::search. That instance is a bit more complicated: If the logtype query contains no wildcards, we don't want to escape the escape characters (double-escape) since the logtype query won't be used in wildcard matches. I guess the most straightforward way to do this would be to do it while searching the logtype for wildcards in the Subquery constructor.
Co-authored-by: kirkrodrigues <[email protected]>
kirkrodrigues
approved these changes
Dec 5, 2023
kirkrodrigues
approved these changes
Dec 5, 2023
jackluo923
approved these changes
Dec 5, 2023
kirkrodrigues
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Reference
#163
Description
When creating the logtype dictionary, the characters of the variable placeholders in the original log events are not properly escaped, which causes #163. This PR fixes this problem by properly escaping these characters and tracking the location of the escaped placeholders for each logtype dictionary entry. It also handles the escape in
ffirelated code.Rules we added in this PR for logtype encoding:
Validation performed