add jsonExtractUnescape Helper (#962)

* add jsonExtractUnescape Helper
crowdsecurity · Sep 10, 2021 · e651379 · e651379
1 parent e67fad0
commit e651379
Show file tree

Hide file tree

Showing 3 changed files with 68 additions and 8 deletions.
diff --git a/pkg/exprhelpers/exprlib.go b/pkg/exprhelpers/exprlib.go
@@ -33,14 +33,15 @@ func Upper(s string) string {
 
 func GetExprEnv(ctx map[string]interface{}) map[string]interface{} {
 	var ExprLib = map[string]interface{}{
-		"Atof":           Atof,
-		"JsonExtract":    JsonExtract,
-		"JsonExtractLib": JsonExtractLib,
-		"File":           File,
-		"RegexpInFile":   RegexpInFile,
-		"Upper":          Upper,
-		"IpInRange":      IpInRange,
-		"TimeNow":        TimeNow,
+		"Atof":                Atof,
+		"JsonExtract":         JsonExtract,
+		"JsonExtractUnescape": JsonExtractUnescape,
+		"JsonExtractLib":      JsonExtractLib,
+		"File":                File,
+		"RegexpInFile":        RegexpInFile,
+		"Upper":               Upper,
+		"IpInRange":           IpInRange,
+		"TimeNow":             TimeNow,
 	}
 	for k, v := range ctx {
 		ExprLib[k] = v

diff --git a/pkg/exprhelpers/jsonextract.go b/pkg/exprhelpers/jsonextract.go
@@ -30,6 +30,25 @@ func JsonExtractLib(jsblob string, target ...string) string {
 	return strvalue
 }
 
+func JsonExtractUnescape(jsblob string, target ...string) string {
+	value, err := jsonparser.GetString(
+		jsonparser.StringToBytes(jsblob),
+		target...,
+	)
+
+	if err != nil {
+		if err == jsonparser.KeyPathNotFoundError {
+			log.Debugf("%+v doesn't exist", target)
+			return ""
+		}
+		log.Errorf("JsonExtractUnescape : %+v : %s", target, err)
+		return ""
+	}
+	log.Tracef("extract path %+v", target)
+	strvalue := string(value)
+	return strvalue
+}
+
 func JsonExtract(jsblob string, target string) string {
 	if !strings.HasPrefix(target, "[") {
 		target = strings.Replace(target, "[", ".[", -1)

diff --git a/pkg/exprhelpers/jsonextract_test.go b/pkg/exprhelpers/jsonextract_test.go
@@ -47,3 +47,43 @@ func TestJsonExtract(t *testing.T) {
 	}
 
 }
+func TestJsonExtractUnescape(t *testing.T) {
+	if err := Init(); err != nil {
+		log.Fatalf(err.Error())
+	}
+
+	err := FileInit(TestFolder, "test_data_re.txt", "regex")
+	if err != nil {
+		log.Fatalf(err.Error())
+	}
+
+	tests := []struct {
+		name         string
+		jsonBlob     string
+		targetField  string
+		expectResult string
+	}{
+		{
+			name:         "basic json extract",
+			jsonBlob:     `{"log" : "\"GET /JBNwtQ6i.blt HTTP/1.1\" 200 13 \"-\" \"Craftbot\""}`,
+			targetField:  "log",
+			expectResult: "\"GET /JBNwtQ6i.blt HTTP/1.1\" 200 13 \"-\" \"Craftbot\"",
+		},
+		{
+			name:         "basic json extract with non existing field",
+			jsonBlob:     `{"test" : "1234"}`,
+			targetField:  "non_existing_field",
+			expectResult: "",
+		},
+	}
+
+	for _, test := range tests {
+		result := JsonExtractUnescape(test.jsonBlob, test.targetField)
+		isOk := assert.Equal(t, test.expectResult, result)
+		if !isOk {
+			t.Fatalf("test '%s' failed", test.name)
+		}
+		log.Printf("test '%s' : OK", test.name)
+	}
+
+}