diff --git a/internal/database/redis/count.go b/internal/database/redis/count.go index c0faac3..700153d 100644 --- a/internal/database/redis/count.go +++ b/internal/database/redis/count.go @@ -8,6 +8,7 @@ import ( "github.com/Issif/redisearch-go/redisearch" "github.com/falcosecurity/falcosidekick-ui/internal/models" + "github.com/falcosecurity/falcosidekick-ui/internal/utils" ) func CountKey(client *redisearch.Client, args *models.Arguments) (models.Results, error) { @@ -49,7 +50,7 @@ func CountKeyBy(client *redisearch.Client, args *models.Arguments) (models.Resul continue } for _, j := range strings.Split(key.(string), ",") { - ag[j] += count + ag[utils.UnEscape(j)] += count all += count } } diff --git a/internal/database/redis/query.go b/internal/database/redis/query.go index d4a96ad..d872ce1 100644 --- a/internal/database/redis/query.go +++ b/internal/database/redis/query.go @@ -12,7 +12,7 @@ import ( func newQuery(args *models.Arguments) string { var filter, priority, rule, source, hostname, tags, since string if args.Filter != "" { - filter = args.Filter + "* " + filter = utils.Escape(args.Filter) + "* " } if args.Priority != "" { p := strings.Split(args.Priority, ",") @@ -36,14 +36,14 @@ func newQuery(args *models.Arguments) string { source = fmt.Sprintf("(%v) ", strings.Join(r, " | ")) } if args.Hostname != "" { - r := strings.Split(args.Hostname, ",") + r := strings.Split(utils.Escape(args.Hostname), ",") for i, j := range r { r[i] = fmt.Sprintf("@hostname:%v", j) } hostname = fmt.Sprintf("(%v) ", strings.Join(r, " | ")) } if args.Tags != "" { - r := strings.Split(args.Tags, ",") + r := strings.Split(utils.Escape(args.Tags), ",") for i, j := range r { r[i] = fmt.Sprintf("@tags:%v", j) } diff --git a/internal/database/redis/set.go b/internal/database/redis/set.go index 4585070..aa08ded 100644 --- a/internal/database/redis/set.go +++ b/internal/database/redis/set.go @@ -8,6 +8,7 @@ import ( "github.com/Issif/redisearch-go/redisearch" "github.com/falcosecurity/falcosidekick-ui/configuration" "github.com/falcosecurity/falcosidekick-ui/internal/models" + "github.com/falcosecurity/falcosidekick-ui/internal/utils" ) func SetKey(client *redisearch.Client, event *models.Event) error { @@ -21,12 +22,12 @@ func SetKey(client *redisearch.Client, event *models.Event) error { Set("output", event.Output). Set("source", event.Source). Set("timestamp", event.Time.UnixNano()/1e3). - Set("tags", strings.Join(event.Tags, ",")). + Set("tags", utils.Escape(strings.Join(event.Tags, ","))). Set("json", string(jsonString)). Set("uuid", event.UUID). SetTTL(c.TTL) if event.Hostname != "" { - doc.Set("hostname", event.Hostname) + doc.Set("hostname", utils.Escape(event.Hostname)) } err := client.Index([]redisearch.Document{doc}...) diff --git a/internal/utils/utils.go b/internal/utils/utils.go index 81d46c4..7c93234 100644 --- a/internal/utils/utils.go +++ b/internal/utils/utils.go @@ -7,6 +7,7 @@ import ( "regexp" "sort" "strconv" + "strings" "github.com/falcosecurity/falcosidekick-ui/configuration" ) @@ -142,3 +143,11 @@ func GetPriortiyInt(prio string) int { return -1 } } + +func Escape(s string) string { + return strings.ReplaceAll(s, "-", `\-`) +} + +func UnEscape(s string) string { + return strings.ReplaceAll(s, `\-`, "-") +}