Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
tree: 1429ad8091
Fetching contributors…

Cannot retrieve contributors at this time

64 lines (55 sloc) 1.985 kb
%{
#define _GPERF_
#include "grok.h"
#include "grok_logging.h"
#include "stringhelper.h"
int filter_jsonencode(grok_match_t *gm, char **value, int *value_len,
int *value_size);
int filter_shellescape(grok_match_t *gm, char **value, int *value_len,
int *value_size);
int filter_shelldqescape(grok_match_t *gm, char **value, int *value_len,
int *value_size);
%}
%define hash-function-name _string_filter_hash
%define lookup-function-name string_filter_lookup
%define slot-name name
%readonly-tables
%language=ANSI-C
%compare-strncmp
%switch=1
%struct-type
struct filter {
const char *name;
int (*func)(grok_match_t *gm, char **value, int *value_len,
int *value_size);
};
%%
jsonencode,filter_jsonencode
shellescape,filter_shellescape
shelldqescape,filter_shelldqescape
%%
int filter_jsonencode(grok_match_t *gm, char **value, int *value_len,
int *value_size) {
grok_log(gm->grok, LOG_REACTION, "filter executing");
/* json.org says " \ and / should be escaped, in addition to
* contol characters (newline, etc).
*
* Some validators will pass non-escaped forward slashes (solidus) but
* we'll escape it anyway. */
string_escape(value, value_len, value_size, "\\\"/", 3, ESCAPE_LIKE_C);
string_escape(value, value_len, value_size, "", 0,
ESCAPE_NONPRINTABLE | ESCAPE_UNICODE);
return 0;
}
int filter_shellescape(grok_match_t *gm, char **value, int *value_len,
int *value_size) {
grok_log(gm->grok, LOG_REACTION, "filter executing");
string_escape(value, value_len, value_size, "`^()&{}[]$*?!|;'\"\\", -1, ESCAPE_LIKE_C);
return 0;
}
int filter_shelldqescape(grok_match_t *gm, char **value, int *value_len,
int *value_size) {
grok_log(gm->grok, LOG_REACTION, "filter executing");
string_escape(value, value_len, value_size, "\\`$\"", -1, ESCAPE_LIKE_C);
return 0;
}
Jump to Line
Something went wrong with that request. Please try again.