Closed traetox closed 4 years ago
There is a panic in how backticks are parsed in config files.
Here is the panic/traceback:
panic: missing end quote goroutine 1 [running]: github.com/gravwell/gcfg.unquote(0xc0000ea300, 0x28, 0x5, 0xc0000ea300) /home/kris/mygo/pkg/mod/github.com/gravwell/gcfg@v1.2.7/read.go:45 +0x304 github.com/gravwell/gcfg.readIntoPass(0xc000087670, 0x715ea0, 0xc0000c2c60, 0xc0001365c0, 0xc0000b01e0, 0xc000160000, 0xd21, 0x1e00, 0xc0000ae500, 0x0, ...) /home/kris/mygo/pkg/mod/github.com/gravwell/gcfg@v1.2.7/read.go:160 +0xcd2 github.com/gravwell/gcfg.readInto(0x715ea0, 0xc0000c2c60, 0xc0001365c0, 0xc0000b01e0, 0xc000160000, 0xd21, 0x1e00, 0x0, 0x40c678) /home/kris/mygo/pkg/mod/github.com/gravwell/gcfg@v1.2.7/read.go:194 +0xda github.com/gravwell/gcfg.ReadInto(0x715ea0, 0xc0000c2c60, 0x810100, 0xc0000a3200, 0xc00015a000, 0xd21) /home/kris/mygo/pkg/mod/github.com/gravwell/gcfg@v1.2.7/read.go:214 +0x132 github.com/gravwell/gcfg.ReadStringInto(...) /home/kris/mygo/pkg/mod/github.com/gravwell/gcfg@v1.2.7/read.go:221 github.com/gravwell/gravwell/v3/ingest/config.LoadConfigBytes(0x715ea0, 0xc0000c2c60, 0xc000158000, 0xd21, 0x1e00, 0x0, 0x0) /home/kris/githubwork/gravwell/ingest/config/loader.go:80 +0xd5 github.com/gravwell/gravwell/v3/ingest/config.LoadConfigFile(0x715ea0, 0xc0000c2c60, 0x7ab041, 0x23, 0x0, 0x0) /home/kris/githubwork/gravwell/ingest/config/loader.go:70 +0x306 main.GetConfig(0x7ab041, 0x23, 0x1400, 0x7efbfd4ba400, 0x20300000000000) /home/kris/githubwork/gravwell/ingesters/SimpleRelay/config.go:77 +0x76 main.main() /home/kris/githubwork/gravwell/ingesters/SimpleRelay/main.go:81 +0x65
Here is the config snippet that triggered it:
[Listener "sd"] Bind-String="0.0.0.0:8888" Tag-Name=sdtest4 Ignore-Timestamps=true Preprocessor=cvesplit Preprocessor=ts [Preprocessor "cvesplit"] Type=jsonarraysplit Extraction="cves" Passthrough-Misses=false Force-JSON-Object=true Additional-Fields="ip,last_seen" [Preprocessor "ts"] Type=regextimestamp Regex=`"last_seen":\s*"(?P<timestamp>[^"]+)"` TS-Match-Name=timestamp
There is a panic in how backticks are parsed in config files.
Here is the panic/traceback:
Here is the config snippet that triggered it: