parser: Make "braced string" sub-parser more strict

threathunters-io · Dec 27, 2023 · fba5f29 · fba5f29
1 parent 7b03ca6
commit fba5f29
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/src/parser.rs b/src/parser.rs
@@ -425,7 +425,7 @@ fn parse_str_dq(input: &[u8]) -> IResult<&[u8], &[u8]> {
 
 #[inline(always)]
 fn parse_str_braced(input: &[u8]) -> IResult<&[u8], &[u8]> {
-    delimited(tag("{"), take_while(|c| c != b'}'), tag("}"))(input)
+    delimited(tag("{ "), take_until(" }"), tag(" }"))(input)
 }
 
 #[inline(always)]
@@ -876,6 +876,7 @@ mod test {
         do_parse(include_bytes!("testdata/line-anom-abend-2.txt")).unwrap();
         do_parse(include_bytes!("testdata/line-user-auth.txt")).unwrap();
         do_parse(include_bytes!("testdata/line-sockaddr-unix.txt")).unwrap();
+        do_parse(include_bytes!("testdata/line-sockaddr-unix-2.txt")).unwrap();
         do_parse(include_bytes!("testdata/line-user-auth-2.txt")).unwrap();
     }
 

diff --git a/src/testdata/line-sockaddr-unix-2.txt b/src/testdata/line-sockaddr-unix-2.txt
@@ -0,0 +1 @@
+type=SOCKADDR msg=audit(1703653288.035:118019478): saddr=01002F746D702F7B39653263623038372D393734342D343137622D383435662D3035636136636534353763317D0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000SADDR={ fam=local path=/tmp/{9e2cb087-9744-417b-845f-05ca6ce457c1} }
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		type=SOCKADDR msg=audit(1703653288.035:118019478): saddr=01002F746D702F7B39653263623038372D393734342D343137622D383435662D3035636136636534353763317D0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000SADDR={ fam=local path=/tmp/{9e2cb087-9744-417b-845f-05ca6ce457c1} }