corelight / zeekjs

ZeekJS - Experimental JavaScript support for Zeek.
BSD 3-Clause "New" or "Revised" License
9 stars 4 forks source link

Support Zeek->JS conversion of pattern type (to string)? #77

Closed simeonmiteff closed 9 months ago

simeonmiteff commented 1 year ago

Would this make any sense?

diff --git a/src/Types.cc b/src/Types.cc
index 44a9a90..342bcdc 100644
--- a/src/Types.cc
+++ b/src/Types.cc
@@ -4,6 +4,7 @@
 #include "Types.h"
 #include "ZeekCompat.h"

+#include "zeek/RE.h"
 #include "zeek/IPAddr.h"
 #include "zeek/IntrusivePtr.h"
 #include "zeek/Type.h"
@@ -476,6 +477,8 @@ v8::Local<v8::Value> ZeekValWrapper::Wrap(const zeek::ValPtr& vp, int attr_mask)
       return wrap_table(vp);
     case zeek::TYPE_ENUM:
       return wrap_enum(vp);
+    case zeek::TYPE_PATTERN:
+      return v8_str(vp->AsPatternVal()->AsPattern()->PatternText());
     case zeek::TYPE_LIST: {  // types (?)
       v8::Local<v8::Context> context = isolate_->GetCurrentContext();
       zeek::ListVal* lval = vp->AsListVal();

It would be one-way (no JS->Zeek) and just stringify the pattern (I don't think conversion to a JS RegExp object is feasible).

Alternatively, is it possible/desireable to throw a JS exception instread of the eprintf() and returning v8::Null (as this would make handling unsupported type errors explicit in JS-land)?

awelzel commented 1 year ago

It would be one-way (no JS->Zeek) and just stringify the pattern (I don't think conversion to a JS RegExp object is feasible).

Yeah, that seems fine. If someone really wants to have a RegExp they can try to construct it in JS from the string. I do wonder if the JS -> Zeek route should work though.

Did you have a use-cases, or was that from poking at global_ids()? :-)

simeonmiteff commented 12 months ago

Yeah, that seems fine. If someone really wants to have a RegExp they can try to construct it in JS from the string. I do wonder if the JS -> Zeek route should work though.

Ok, I'll look into JS -> Zeek.

Did you have a use-cases, or was that from poking at global_ids()? :-)

Sort of: the poking at global_ids() was in persuit of another goal that would also benefit from having more Zeek and JS types being convertable to eachother. So, the use case is not even half-baked yet. I figured this would be low priority hence I'm happy to hack at it on my own and open a PR when it works. Happy to close this issue if you prefer.