Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bypass rule tree error #709

Closed
ppcad opened this issue Nov 20, 2024 · 0 comments · Fixed by #719
Closed

Bypass rule tree error #709

ppcad opened this issue Nov 20, 2024 · 0 comments · Fixed by #719
Assignees
Labels
bug Something isn't working

Comments

@ppcad
Copy link
Collaborator

ppcad commented Nov 20, 2024

Logprep matches filter keys on event values if the environment variable LOGPREP_BYPASS_RULE_TREE is set and a specific value is being filtered.
This raises a TypeError while parsing the filter expression, since it tries to get the key for a event value, which is a string:

logprep/filter/expression/filter_expression.py", line 90, in _get_value   
    current = current[item]
TypeError: string indices must be integers

Expected behavior
Rules never use event values to match filter keys.

Steps to reproduce

  1. Start Logprep with the environment variable LOGPREP_BYPASS_RULE_TREE being set
  2. Create any rule with a filter like key1.key2: value (just key1.key2 without a value won't cause problems)
  3. Send an event like {"key1": "key2 is not a key"}

The rule will match and a TypeError will be raised.

Environment

Logprep version: 56cf412
Python version: 3.11

@ppcad ppcad added the bug Something isn't working label Nov 20, 2024
@ppcad ppcad self-assigned this Nov 29, 2024
@ppcad ppcad linked a pull request Dec 5, 2024 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant