extends regex for json logs

coreruleset · Dec 9, 2024 · 2a7779a · 2a7779a
1 parent 6c1b1cb
commit 2a7779a
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 4 deletions.
diff --git a/waflog/read.go b/waflog/read.go
@@ -28,7 +28,7 @@ func (ll *FTWLogLines) TriggeredRules() []uint {
 	ll.triggeredRulesInitialized = true
 
 	lines := ll.getMarkedLines()
-	regex := regexp.MustCompile(`\[id "(\d+)"\]|"id":\s*"?(\d+)"?`)
+	regex := regexp.MustCompile(`\[id \\?"(\d+)\\?"\]|"id":\s*"?(\d+)"?`)
 	for _, line := range lines {
 		log.Trace().Msgf("ftw/waflog: Looking for any rule in '%s'", line)
 		match := regex.FindAllSubmatch(line, -1)

diff --git a/waflog/read_test.go b/waflog/read_test.go
@@ -371,11 +371,11 @@ func (s *readTestSuite) TestFindAllIdsInLogs() {
 	markerLine := "X-cRs-TeSt: " + stageID
 	logLines := fmt.Sprint("\n", markerLine,
 		`[id "1"] something else [id "2"]`,
-		`"id": 3, something else {"id":4}`+"\n",
+		`"id": 3, something else {"id":4},`,
+		`something else [id \"5\"]`+"\n",
 		"\n", markerLine)
 	filename, err := utils.CreateTempFileWithContent(logLines, "test-errorlog-")
 	s.Require().NoError(err)
-
 	cfg.LogFile = filename
 	log, err := os.Open(filename)
 	s.Require().NoError(err)
@@ -388,9 +388,10 @@ func (s *readTestSuite) TestFindAllIdsInLogs() {
 	ll.WithEndMarker([]byte(markerLine))
 
 	foundRuleIds := ll.TriggeredRules()
-	s.Len(foundRuleIds, 4)
+	s.Len(foundRuleIds, 5)
 	s.Contains(foundRuleIds, uint(1))
 	s.Contains(foundRuleIds, uint(2))
 	s.Contains(foundRuleIds, uint(3))
 	s.Contains(foundRuleIds, uint(4))
+	s.Contains(foundRuleIds, uint(5))
 }