x-pack/filebeat/input/httpjson: fix relation parameter in getRFC5988L…

…ink (#34622)

Previously the regular expression required a space separating the "ral"
tag from previous text. While the examples in RFC5988 show a separating
space, the ABNF does not indicate a requirement; the space that does
exist in the examples is allowed by RFC2616 because of the implied *LWS
rule for token separation.

The new regular expression also more carefully considers quoting for rel
parameters and semicolon requirements.

CHANGELOG.next.asciidoc

@@ -128,6 +128,7 @@ automatic splitting at root level, if root level element is an array. {pull}3415
 
 - Allow the `misp` fileset in the Filebeat `threatintel` module to ignore CIDR ranges for an IP field. {issue}29949[29949] {pull}34195[34195]
 - Remove incorrect reference to CEL ext extensions package. {issue}34610[34610] {pull}34620[34620]
+- Fix handling of RFC5988 links' relation parameters by `getRFC5988Link` in HTTPJSON. {issue}34603[34603] {pull}34622[34622]
 
 *Auditbeat*
 

x-pack/filebeat/input/httpjson/value_tpl.go

@@ -228,7 +228,7 @@ func parseTimestampNano(ns int64) time.Time {
 	return time.Unix(0, ns).UTC()
 }
 
-var regexpLinkRel = regexp.MustCompile(`<(.*)>;.*\srel\="?([^;"]*)`)
+var regexpLinkRel = regexp.MustCompile(`<(.*)>.*;\s*rel\=("[^"]*"|[^"][^;]*[^"])`)
 
 func getMatchLink(rel string, linksSplit []string) string {
 	for _, link := range linksSplit {
@@ -241,7 +241,11 @@ func getMatchLink(rel string, linksSplit []string) string {
 			continue
 		}
 
-		if matches[2] != rel {
+		linkRel := matches[2]
+		if len(linkRel) > 1 && linkRel[0] == '"' { // We can only have a leading quote if we also have a separate trailing quote.
+			linkRel = linkRel[1 : len(linkRel)-1]
+		}
+		if linkRel != rel {
 			continue
 		}
 

x-pack/filebeat/input/httpjson/value_tpl_test.go

@@ -301,6 +301,24 @@ func TestValueTpl(t *testing.T) {
 			paramDefVal: "https://example.com/default",
 			expectedVal: "https://example.com/default",
 		},
+		{
+			name:  "func getRFC5988Link no space link parameters",
+			value: `[[ getRFC5988Link "next" .last_response.header.Link ]]`,
+			paramCtx: &transformContext{
+				firstEvent: &mapstr.M{},
+				lastEvent:  &mapstr.M{},
+				lastResponse: newTestResponse(
+					nil,
+					http.Header{"Link": []string{
+						`<https://example.com/api/v1/users?before=00ubfjQEMYBLRUWIEDKK>;title="Page 1";rel="previous",
+						<https://example.com/api/v1/users?after=00ubfjQEMYBLRUWIEDKK>;title="Page 3";rel="next"`,
+					}},
+					"",
+				),
+			},
+			paramTr:     transformable{},
+			expectedVal: "https://example.com/api/v1/users?after=00ubfjQEMYBLRUWIEDKK",
+		},
 		{
 			name:        "can execute functions pipeline",
 			setup:       func() { timeNow = func() time.Time { return time.Unix(1604582732, 0).UTC() } },