Add startswith as a string comparison operator. #623
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Currently, the only way to do a substring match is the 'contains' operator. This is less than ideal when you specifically want to test the beginning of a string for the substring, as contains will traverse the entire string and may return a match in the middle of the string. Add a startswith operator that specifically tests for a substring match at the beginning of the string. There were a few places in non-string comparison operators where any operator not in the set of supported operators was assumed to be 'contains'. Replace this with checks for all operators including 'icontains', 'startswith' with appropriate error messages.
mstemm
added a commit
to falcosecurity/falco
that referenced
this pull request
Jul 9, 2016
draios/sysdig#623 adds support for a startswith to allow for string prefix matching. Use that operator for rules that really want to check the beginning of a pathname, directory, etc. to make them faster and avoid FPs.
mstemm
added a commit
to falcosecurity/falco
that referenced
this pull request
Jul 9, 2016
draios/sysdig#623 adds support for a startswith operator to allow for string prefix matching. Modify the parser to recognize that operator, and use that operator for rules that really want to check the beginning of a pathname, directory, etc. to make them faster and avoid FPs.
mstemm
added a commit
to falcosecurity/falco
that referenced
this pull request
Jul 11, 2016
draios/sysdig#623 adds support for a startswith operator to allow for string prefix matching. Modify the parser to recognize that operator, and use that operator for rules that really want to check the beginning of a pathname, directory, etc. to make them faster and avoid FPs.
gianlucaborello
pushed a commit
that referenced
this pull request
Aug 16, 2016
Currently, the only way to do a substring match is the 'contains' operator. This is less than ideal when you specifically want to test the beginning of a string for the substring, as contains will traverse the entire string and may return a match in the middle of the string. Add a startswith operator that specifically tests for a substring match at the beginning of the string. There were a few places in non-string comparison operators where any operator not in the set of supported operators was assumed to be 'contains'. Replace this with checks for all operators including 'icontains', 'startswith' with appropriate error messages.
dmyerscough
pushed a commit
to dmyerscough/sysdig
that referenced
this pull request
Mar 3, 2017
Currently, the only way to do a substring match is the 'contains' operator. This is less than ideal when you specifically want to test the beginning of a string for the substring, as contains will traverse the entire string and may return a match in the middle of the string. Add a startswith operator that specifically tests for a substring match at the beginning of the string. There were a few places in non-string comparison operators where any operator not in the set of supported operators was assumed to be 'contains'. Replace this with checks for all operators including 'icontains', 'startswith' with appropriate error messages.
leogr
pushed a commit
to falcosecurity/rules
that referenced
this pull request
Dec 21, 2022
draios/sysdig#623 adds support for a startswith operator to allow for string prefix matching. Modify the parser to recognize that operator, and use that operator for rules that really want to check the beginning of a pathname, directory, etc. to make them faster and avoid FPs.
leogr
pushed a commit
to falcosecurity/rules
that referenced
this pull request
Dec 21, 2022
draios/sysdig#623 adds support for a startswith operator to allow for string prefix matching. Modify the parser to recognize that operator, and use that operator for rules that really want to check the beginning of a pathname, directory, etc. to make them faster and avoid FPs.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add startswith as a string comparison operator.
Currently, the only way to do a substring match is the 'contains'
operator. This is less than ideal when you specifically want to test the
beginning of a string for the substring, as contains will traverse the
entire string and may return a match in the middle of the string.
Add a startswith operator that specifically tests for a substring match
at the beginning of the string.
There were a few places in non-string comparison operators where any
operator not in the set of supported operators was assumed to be
'contains'. Replace this with checks for all operators including
'icontains', 'startswith' with appropriate error messages.
@luca3m @ldegio @gianlucaborello