adds regex description

coreruleset · Dec 9, 2024 · 9ae74a2 · 9ae74a2
1 parent 2a7779a
commit 9ae74a2
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/waflog/read.go b/waflog/read.go
@@ -28,6 +28,14 @@ func (ll *FTWLogLines) TriggeredRules() []uint {
 	ll.triggeredRulesInitialized = true
 
 	lines := ll.getMarkedLines()
+
+	// This regex provides flexibility in parsing how the rule ID is logged.
+	// `\[id \\?"(\d+)\\?"\]` supports:
+	//	- [id "999999"]
+	//	- [id \"999999\"] (escaped quotes)
+	// `"id":\s*"?(\d+)"?` supports:
+	//	- ["id":"999999"]
+	//	- {"id":4}
 	regex := regexp.MustCompile(`\[id \\?"(\d+)\\?"\]|"id":\s*"?(\d+)"?`)
 	for _, line := range lines {
 		log.Trace().Msgf("ftw/waflog: Looking for any rule in '%s'", line)