Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use go-shellquote to split rules into arguments #115

Merged
merged 5 commits into from
Jul 14, 2022

Conversation

andrewkroh
Copy link
Member

@andrewkroh andrewkroh commented Jul 7, 2022

The rule implementation naively split rules using strings.Fields, but this did not
handle arguments that were quoted in cases where the arguments themselves
contain spaces.

Now go-shellquote is used to split the arguments before parsing.

Fixes #114

The rule implementation naively split rules using strings.Fields, but this did not
handle arguments that were quoted in cases where the arguments themselves
contain spaces.

Now go-shellquote is used to split the arguments before parsing.

Fixes elastic#114
@elasticmachine
Copy link
Collaborator

elasticmachine commented Jul 7, 2022

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-07-14T20:00:23.302+0000

  • Duration: 2 min 27 sec

Test stats 🧪

Test Results
Failed 0
Passed 389
Skipped 40
Total 429

@andrewkroh andrewkroh marked this pull request as ready for review July 7, 2022 19:48
@andrewkroh andrewkroh added Team:Security-External Integrations Label for the Security External Integrations team bug labels Jul 7, 2022
@andrewkroh andrewkroh requested a review from a team July 7, 2022 19:52
rule/gen_testdata_test.go Outdated Show resolved Hide resolved
rule/gen_testdata_test.go Outdated Show resolved Hide resolved
@andrewkroh andrewkroh merged commit 6a33928 into elastic:main Jul 14, 2022
renini pushed a commit to renini/go-libaudit that referenced this pull request Jun 26, 2024
The rule implementation naively split rules using strings.Fields, but this did not
handle arguments that were quoted in cases where the arguments themselves
contain spaces.

Now go-shellquote is used to split the arguments before parsing.

Fixes elastic#114
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Team:Security-External Integrations Label for the Security External Integrations team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

rule - File paths with spaces fail in rules
3 participants