[7.17](backport #34622) x-pack/filebeat/input/httpjson: fix relation …

…parameter handling in getRFC5988Link (#34868)

* x-pack/filebeat/input/httpjson: fix relation parameter in getRFC5988Link (#34622)

Previously the regular expression required a space separating the "ral"
tag from previous text. While the examples in RFC5988 show a separating
space, the ABNF does not indicate a requirement; the space that does
exist in the examples is allowed by RFC2616 because of the implied *LWS
rule for token separation.

The new regular expression also more carefully considers quoting for rel
parameters and semicolon requirements.

(cherry picked from commit ba67aa8)

* remove irrelevant changelog lines
* use common.MapStr
* adjust test for previous split behaviour
  Between 7.17 and 8.6, the capacity to split link headers from single strings was
  added, so make each link a single string

---------

Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>
Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>

CHANGELOG.next.asciidoc

@@ -41,6 +41,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix dropped events when monitor a beat under the agent and send its `Host info` log entry. {pull}34599[34599]
 - Fix panics when a processor is closed twice {pull}34647[34647]
 - Gracefully handle Windows event channel not found errors in winlog input. {issue}30201[30201] {pull}34605[34605]
+- Fix handling of RFC5988 links' relation parameters by `getRFC5988Link` in HTTPJSON. {issue}34603[34603] {pull}34622[34622]
 
 *Heartbeat*
 

x-pack/filebeat/input/httpjson/internal/v2/value_tpl.go

@@ -208,7 +208,7 @@ func parseTimestampNano(ns int64) time.Time {
 	return time.Unix(0, ns).UTC()
 }
 
-var regexpLinkRel = regexp.MustCompile(`<(.*)>;.*\srel\="?([^;"]*)`)
+var regexpLinkRel = regexp.MustCompile(`<(.*)>.*;\s*rel\=("[^"]*"|[^"][^;]*[^"])`)
 
 func getRFC5988Link(rel string, links []string) string {
 	for _, link := range links {
@@ -221,7 +221,11 @@ func getRFC5988Link(rel string, links []string) string {
 			continue
 		}
 
-		if matches[2] != rel {
+		linkRel := matches[2]
+		if len(linkRel) > 1 && linkRel[0] == '"' { // We can only have a leading quote if we also have a separate trailing quote.
+			linkRel = linkRel[1 : len(linkRel)-1]
+		}
+		if linkRel != rel {
 			continue
 		}
 

x-pack/filebeat/input/httpjson/internal/v2/value_tpl_test.go

@@ -227,6 +227,24 @@ func TestValueTpl(t *testing.T) {
 			paramDefVal: "https://example.com/default",
 			expectedVal: "https://example.com/default",
 		},
+		{
+			name:  "func getRFC5988Link no space link parameters",
+			value: `[[ getRFC5988Link "next" .last_response.header.Link ]]`,
+			paramCtx: &transformContext{
+				firstEvent: &common.MapStr{},
+				lastEvent:  &common.MapStr{},
+				lastResponse: newTestResponse(
+					nil,
+					http.Header{"Link": []string{
+						`<https://example.com/api/v1/users?before=00ubfjQEMYBLRUWIEDKK>;title="Page 1";rel="previous"`,
+						`<https://example.com/api/v1/users?after=00ubfjQEMYBLRUWIEDKK>;title="Page 3";rel="next"`,
+					}},
+					"",
+				),
+			},
+			paramTr:     transformable{},
+			expectedVal: "https://example.com/api/v1/users?after=00ubfjQEMYBLRUWIEDKK",
+		},
 		{
 			name:        "can execute functions pipeline",
 			setup:       func() { timeNow = func() time.Time { return time.Unix(1604582732, 0).UTC() } },