diff --git a/changelog/unreleased/issue-24247.toml b/changelog/unreleased/issue-24247.toml new file mode 100644 index 0000000000..b0beedef94 --- /dev/null +++ b/changelog/unreleased/issue-24247.toml @@ -0,0 +1,5 @@ +type = "f" +message = "Honor character literals in pipeline rules." + +pulls = ["24295"] +issues = ["24247"] diff --git a/graylog2-server/src/main/java/org/graylog/plugins/pipelineprocessor/parser/PipelineRuleParser.java b/graylog2-server/src/main/java/org/graylog/plugins/pipelineprocessor/parser/PipelineRuleParser.java index 2cbc47a908..06c38fe29c 100644 --- a/graylog2-server/src/main/java/org/graylog/plugins/pipelineprocessor/parser/PipelineRuleParser.java +++ b/graylog2-server/src/main/java/org/graylog/plugins/pipelineprocessor/parser/PipelineRuleParser.java @@ -511,10 +511,18 @@ public class PipelineRuleParser { exprs.put(ctx, expr); } + /** + * Handle chars like strings. + * There is no dedicated char type for Graylog rules and, strictly speaking, we should error out. But we have + * been silently allowing (and ignoring) chars for 10 years.To not break existing rules, we continue to allow + * them. Except now we actually honor the expression value. + */ @Override public void exitChar(RuleLangParser.CharContext ctx) { - // TODO - super.exitChar(ctx); + final String text = unescape(unquote(ctx.getText(), '\'')); + final StringExpression expr = new StringExpression(ctx.getStart(), text); + log.trace("CHAR: ctx {} => {}", ctx, expr); + exprs.put(ctx, expr); } @Override diff --git a/graylog2-server/src/test/java/org/graylog/plugins/pipelineprocessor/parser/PipelineRuleParserTest.java b/graylog2-server/src/test/java/org/graylog/plugins/pipelineprocessor/parser/PipelineRuleParserTest.java index 7edb7146be..aa52249dca 100644 --- a/graylog2-server/src/test/java/org/graylog/plugins/pipelineprocessor/parser/PipelineRuleParserTest.java +++ b/graylog2-server/src/test/java/org/graylog/plugins/pipelineprocessor/parser/PipelineRuleParserTest.java @@ -266,6 +266,16 @@ class PipelineRuleParserTest extends BaseParserTest { assertTrue(actionsTriggered.get()); } + @Test + void charLiteral() { + final Rule rule = parseRuleWithOptionalCodegen(); + Message message = messageFactory.createMessage("hello test", "source", DateTime.now(DateTimeZone.UTC)); + final Message processedMsg = evaluateRule(rule, message); + + assertNotNull(processedMsg); + assertEquals("x", processedMsg.getField("x")); + } + @Test void typedFieldAccess() throws Exception { final Rule rule = parseRuleWithOptionalCodegen(); diff --git a/graylog2-server/src/test/resources/org/graylog/plugins/pipelineprocessor/parser/charLiteral.txt b/graylog2-server/src/test/resources/org/graylog/plugins/pipelineprocessor/parser/charLiteral.txt new file mode 100644 index 0000000000..bd6e11d685 --- /dev/null +++ b/graylog2-server/src/test/resources/org/graylog/plugins/pipelineprocessor/parser/charLiteral.txt @@ -0,0 +1,6 @@ +rule "char_literal" +when + true +then + set_field(field: "x", value: 'x'); +end