search

PaloAltoNetworks / minemeld

Main MineMeld documentation repo
379 stars 64 forks source link

tab expansion generates invalid JSON #16

Open abes975 opened 6 years ago

abes975 commented 6 years ago

I'm processing a STIX feed with taxiing.node.Miner linked to a minemeld.redis.RedisSet. Stix feed contain string with tab characters in it. Tab char is escaped with "\t". When get values from the output node via web service, the escaped tab char is expanded generating an invalid json message.

STIX message {"stix_title":"FQDN: mydomain.com\t" }

output JSON message

{"indicator":"mydomain.com ","value":{"stix_title":"FQDN: mydomain.com\t" <SNIP> }

in the indicator string "mydomain.com " the tab is expanded generating an invalid JSON message

jtschichold commented 6 years ago

@abes975 thanks for reporting this! It should be fixed with PaloAltoNetworks/minemeld-core#262