Apache rawrequest escaping binary characters#4303
Merged
MrAnno merged 2 commits intoFeb 20, 2023
Merged
Conversation
Contributor
|
No news file has been detected. Please write one, if applicable. |
Contributor
|
Build FAILURE |
This branch was only taken for control characters (e.g. below 32), so \xXX sequences should be enough, no need for \u even if we are trying to represent utf8 strings. Signed-off-by: Balazs Scheidler <bazsi77@gmail.com>
…racters Fixes syslog-ng#4274 that shows this access.log entry: main:80 152.89.196.211 "-" - [23/Dec/2022:19:04:19 +0100] "\x16\x03\x01" 400 226 "-" "-" Signed-off-by: Balazs Scheidler <bazsi77@gmail.com>
bazsi
force-pushed
the
apache-rawrequest-escaping-binary-characters
branch
from
7db54da to
ae0291a
Compare
MrAnno
approved these changes
Feb 20, 2023
Collaborator
MrAnno
left a comment
MrAnno
left a comment
There was a problem hiding this comment.
We'll need a news entry for this.
MrAnno
added a commit
to MrAnno/syslog-ng
that referenced
this pull request
Feb 28, 2023
Signed-off-by: László Várady <laszlo.varady@anno.io>
Genfood
pushed a commit
to Genfood/syslog-ng
that referenced
this pull request
Jun 14, 2023
Signed-off-by: László Várady <laszlo.varady@anno.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This branch fixes #4274 by:
This might still be a change compared to our 3.38 behaviour, I guess in that case these binary characters were considered a single field and then re-escaped as it was sent out in JSON to ElasticSearch.
So it was probably sent to Elastic as:
"\\x16\\x03\\x01"Note the double backslashes.This patch will make that use binary, e.g. elastic would receive the original:
"\x16\x03\x01"string, which it would de-escape probably. So this is still a change compared to 3.38 but I think this behaviour is better than our previous one, as we are not able to process the binary characters properly.