http_output results in libcurl error: URL using bad/illegal format or missing URL

[therealdwright]

Describe the bug

When configuring the Falco http_output URL as suggested in this reply
The URL is correctly assigned via environment variable, however when events are
generated from Falco I receive an error:
libcurl error: URL using bad/illegal format or missing URL

How to reproduce it

Install Falco using charts, configure outputs using the following method:
falco ... --option http_output.enabled=true --option http_output.user_agent="falcosecurity/falco" --option http_output.url="https://example.com/example/example2"

Expected behaviour

Output is posted to the endpoint

Screenshots

Environment

• Falco version:

Falco version: 0.34.1
Libs version:  0.10.4
Plugin API:    2.0.0
Engine:        16
Driver:
  API version:    3.0.0
  Schema version: 2.0.0
  Default driver: 4.0.0+driver

• System info:

{
  "machine": "x86_64",
  "nodename": "falco-m5jmx",
  "release": "5.4.241-150.347.amzn2.x86_64",
  "sysname": "Linux",
  "version": "#1 SMP Mon Apr 24 23:27:26 UTC 2023"
}

• Cloud provider or hardware configuration:
  Amazon EC2, M5a series instance
• OS:

NAME="Amazon Linux"
VERSION="2"
ID="amzn"
ID_LIKE="centos rhel fedora"
VERSION_ID="2"
PRETTY_NAME="Amazon Linux 2"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"
HOME_URL="https://amazonlinux.com/"

• Kernel:
  Linux 5.4.238-148.347.amzn2.x86_64 #1 SMP Thu Apr 6 19:42:57 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
• Installation method:
  Kubernetes

[leogr]

cc @jasondellaluce @alacuku

[alacuku]

Hi @therealdwright, the quotation marks around the URL are not handled correctly. It should work without them.

[therealdwright]

the quotation marks around the URL are not handled correctly

Would you like me to push a PR to handle the quotes in the URL? I know you are busy with the next release milestone so would like to verify before spending time on writing any code.