From 83a435fc6b653e4495244e1d96f269c4d2229c65 Mon Sep 17 00:00:00 2001 From: MattFromRVA Date: Wed, 6 Dec 2023 14:44:16 -0500 Subject: [PATCH 1/7] added validation for Grok patterns --- src/Grok.Net.Tests/UnitTests.cs | 29 +++++++++++++++++++++++++++++ src/Grok.Net/Grok.cs | 17 +++++++++++++++++ 2 files changed, 46 insertions(+) diff --git a/src/Grok.Net.Tests/UnitTests.cs b/src/Grok.Net.Tests/UnitTests.cs index 855ec78..645bd51 100644 --- a/src/Grok.Net.Tests/UnitTests.cs +++ b/src/Grok.Net.Tests/UnitTests.cs @@ -2,6 +2,7 @@ using System.Collections.Generic; using System.IO; using System.Linq; +using System.Reflection; using GrokNet; using PCRE; using Xunit; @@ -395,5 +396,33 @@ public void GrokResult_To_Dictionary() Assert.True(grokResult.ContainsKey("email")); Assert.True(grokResult.ContainsKey("comment")); } + + [Fact] + public void InvalidPattern_ThrowsException() + { + // Arrange + const string logs = @"06-21-19 21:00:13:589241;15;INFO;main;DECODED: 775233900043 DECODED BY: 18500738 DISTANCE: 1.5165 + 06-22-19 22:00:13:589265;156;WARN;main;DECODED: 775233900043 EMPTY DISTANCE: --------"; + + var sut = new Grok("%{MONTHDA:month}-%{MONTHDAY:day}-%{MONTHDAY:year} %{TIME:timestamp};%{WORD:id};%{LOGLEVEL:loglevel};%{WORD:func};%{GREEDYDATA:msg}"); + + // Act & Assert + FormatException exception = Assert.Throws(() => sut.Parse(logs)); + Assert.Contains("Invalid Grok pattern: Pattern 'MONTHDA' not found.", exception.Message); + } + + [Fact] + public void InvaidPattern_With_Custom_Patterns() + { + // Arrange + const string zipcode = "122001"; + const string email = "Bob.Davis@microsoft.com"; + + var sut = new Grok("%{ZIPCOD:zipcode}:%{EMAILADDRESS:email}", ReadCustomFile()); + + // Act & Assert + FormatException exception = Assert.Throws(() => sut.Parse($"{zipcode}:{email}")); + Assert.Contains("Invalid Grok pattern: Pattern 'ZIPCOD' not found.", exception.Message); + } } } diff --git a/src/Grok.Net/Grok.cs b/src/Grok.Net/Grok.cs index 9df24d5..e3765eb 100644 --- a/src/Grok.Net/Grok.cs +++ b/src/Grok.Net/Grok.cs @@ -4,6 +4,7 @@ using System.Linq; using System.Reflection; using System.Text; +using System.Text.RegularExpressions; using PCRE; namespace GrokNet @@ -104,6 +105,7 @@ public GrokResult Parse(string text) { if (_compiledRegex == null) { + ValidateGrokPattern(_grokPattern); ParsePattern(); } @@ -286,5 +288,20 @@ private string ReplaceWithoutName(PcreMatch match) return "()"; } + + private void ValidateGrokPattern(string grokPattern) + { + var grokPatternRegex = new Regex("%\\{([^:}]+)(?::[^}]+)?(?::[^}]+)?\\}"); + MatchCollection matches = grokPatternRegex.Matches(grokPattern); + + foreach (Match match in matches.Cast()) + { + var patternName = match.Groups[1].Value; + if (!_patterns.ContainsKey(patternName)) + { + throw new FormatException($"Invalid Grok pattern: Pattern '{patternName}' not found."); + } + } + } } } From 4f280f18b009097b5f1de2e07b8828211a533d40 Mon Sep 17 00:00:00 2001 From: MattFromRVA Date: Fri, 8 Dec 2023 08:16:31 -0500 Subject: [PATCH 2/7] Updated validation method to use PCRE --- src/Grok.Net/Grok.cs | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/src/Grok.Net/Grok.cs b/src/Grok.Net/Grok.cs index e3765eb..678fbe8 100644 --- a/src/Grok.Net/Grok.cs +++ b/src/Grok.Net/Grok.cs @@ -1,10 +1,9 @@ -using System; +using System; using System.Collections.Generic; using System.IO; using System.Linq; using System.Reflection; using System.Text; -using System.Text.RegularExpressions; using PCRE; namespace GrokNet @@ -291,10 +290,10 @@ private string ReplaceWithoutName(PcreMatch match) private void ValidateGrokPattern(string grokPattern) { - var grokPatternRegex = new Regex("%\\{([^:}]+)(?::[^}]+)?(?::[^}]+)?\\}"); - MatchCollection matches = grokPatternRegex.Matches(grokPattern); + var grokPatternRegex = new PcreRegex("%\\{([^:}]+)(?::[^}]+)?(?::[^}]+)?\\}"); + IEnumerable matches = grokPatternRegex.Matches(grokPattern); - foreach (Match match in matches.Cast()) + foreach (PcreMatch match in matches) { var patternName = match.Groups[1].Value; if (!_patterns.ContainsKey(patternName)) From bdf3c51b67af7ebed22331b6f587c518f8b02a76 Mon Sep 17 00:00:00 2001 From: Roman Marusyk Date: Sat, 16 Dec 2023 18:33:13 +0200 Subject: [PATCH 3/7] Remove trailing whitespace --- src/Grok.Net.Tests/UnitTests.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Grok.Net.Tests/UnitTests.cs b/src/Grok.Net.Tests/UnitTests.cs index 645bd51..d9edda9 100644 --- a/src/Grok.Net.Tests/UnitTests.cs +++ b/src/Grok.Net.Tests/UnitTests.cs @@ -400,7 +400,7 @@ public void GrokResult_To_Dictionary() [Fact] public void InvalidPattern_ThrowsException() { - // Arrange + // Arrange const string logs = @"06-21-19 21:00:13:589241;15;INFO;main;DECODED: 775233900043 DECODED BY: 18500738 DISTANCE: 1.5165 06-22-19 22:00:13:589265;156;WARN;main;DECODED: 775233900043 EMPTY DISTANCE: --------"; From 2cf72e74f01f2dc3686fb9eaaf2c0c3981ad76ae Mon Sep 17 00:00:00 2001 From: Roman Marusyk Date: Sat, 16 Dec 2023 18:33:22 +0200 Subject: [PATCH 4/7] Remove trailing whitespace --- src/Grok.Net.Tests/UnitTests.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Grok.Net.Tests/UnitTests.cs b/src/Grok.Net.Tests/UnitTests.cs index d9edda9..0c1c6b1 100644 --- a/src/Grok.Net.Tests/UnitTests.cs +++ b/src/Grok.Net.Tests/UnitTests.cs @@ -418,7 +418,7 @@ public void InvaidPattern_With_Custom_Patterns() const string zipcode = "122001"; const string email = "Bob.Davis@microsoft.com"; - var sut = new Grok("%{ZIPCOD:zipcode}:%{EMAILADDRESS:email}", ReadCustomFile()); + var sut = new Grok("%{ZIPCOD:zipcode}:%{EMAILADDRESS:email}", ReadCustomFile()); // Act & Assert FormatException exception = Assert.Throws(() => sut.Parse($"{zipcode}:{email}")); From 879f846051560b507a17f17a4f1d2bf050cadd76 Mon Sep 17 00:00:00 2001 From: Roman Marusyk Date: Sat, 16 Dec 2023 18:34:56 +0200 Subject: [PATCH 5/7] Use global variable instead of param --- src/Grok.Net/Grok.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Grok.Net/Grok.cs b/src/Grok.Net/Grok.cs index 678fbe8..b5dc2a3 100644 --- a/src/Grok.Net/Grok.cs +++ b/src/Grok.Net/Grok.cs @@ -291,7 +291,7 @@ private string ReplaceWithoutName(PcreMatch match) private void ValidateGrokPattern(string grokPattern) { var grokPatternRegex = new PcreRegex("%\\{([^:}]+)(?::[^}]+)?(?::[^}]+)?\\}"); - IEnumerable matches = grokPatternRegex.Matches(grokPattern); + IEnumerable matches = grokPatternRegex.Matches(_grokPattern); foreach (PcreMatch match in matches) { From ab1c96a8422b94005076796d6311fb78429d4f16 Mon Sep 17 00:00:00 2001 From: Roman Marusyk Date: Sat, 16 Dec 2023 18:35:04 +0200 Subject: [PATCH 6/7] Use global variable instead of param --- src/Grok.Net/Grok.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Grok.Net/Grok.cs b/src/Grok.Net/Grok.cs index b5dc2a3..20da855 100644 --- a/src/Grok.Net/Grok.cs +++ b/src/Grok.Net/Grok.cs @@ -104,7 +104,7 @@ public GrokResult Parse(string text) { if (_compiledRegex == null) { - ValidateGrokPattern(_grokPattern); + ValidateGrokPattern(); ParsePattern(); } From dbb99fe78b3e28b3c3d9fdfbebd9d3bc6931ad0c Mon Sep 17 00:00:00 2001 From: Roman Marusyk Date: Sat, 16 Dec 2023 18:39:08 +0200 Subject: [PATCH 7/7] Use global variable instead of param --- src/Grok.Net/Grok.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Grok.Net/Grok.cs b/src/Grok.Net/Grok.cs index 20da855..cc02f5c 100644 --- a/src/Grok.Net/Grok.cs +++ b/src/Grok.Net/Grok.cs @@ -288,7 +288,7 @@ private string ReplaceWithoutName(PcreMatch match) return "()"; } - private void ValidateGrokPattern(string grokPattern) + private void ValidateGrokPattern() { var grokPatternRegex = new PcreRegex("%\\{([^:}]+)(?::[^}]+)?(?::[^}]+)?\\}"); IEnumerable matches = grokPatternRegex.Matches(_grokPattern);