opencybersecurityalliance / kestrel-analytics

This repository hosts community contributed Kestrel analytics
Apache License 2.0
15 stars 12 forks source link

fix test cases for log4shell #9

Closed subbyte closed 2 years ago

subbyte commented 2 years ago

the problem comes when multiple cstr gives results and assembles a prefix then. Need recursive parsing.

not the most elegant fix, but works. I first wanted to call a parser again but this is a simpler solution (manually parse the subst.

two questions to further improve:

  1. what should be the evaluated results for this? ${lower:DC8m:-n} (both runable prefix and default exist)
  2. can we improve the syntax to differentiate the first prefix and following prefix in ${lower:lijsdf:38d:vmm} so lower is recognized as a prefix but lijsdf:38d:vmm will be the value?