From d32ba6c9c00041088eec4e66ab960f783b875de5 Mon Sep 17 00:00:00 2001 From: Patrick Mann Date: Mon, 24 Nov 2025 15:33:22 +0100 Subject: [PATCH] Evaluate char literals in pipeline rules (#24295) * evaluate char literals in pipeline rules * CL --------- Co-authored-by: Maxwell <98284293+kodjo-anipah@users.noreply.github.com> --- changelog/unreleased/issue-24247.toml | 5 +++++ .../pipelineprocessor/parser/PipelineRuleParser.java | 12 ++++++++++-- .../parser/PipelineRuleParserTest.java | 10 ++++++++++ .../plugins/pipelineprocessor/parser/charLiteral.txt | 6 ++++++ 4 files changed, 31 insertions(+), 2 deletions(-) create mode 100644 changelog/unreleased/issue-24247.toml create mode 100644 graylog2-server/src/test/resources/org/graylog/plugins/pipelineprocessor/parser/charLiteral.txt diff --git a/changelog/unreleased/issue-24247.toml b/changelog/unreleased/issue-24247.toml new file mode 100644 index 0000000000..b0beedef94 --- /dev/null +++ b/changelog/unreleased/issue-24247.toml @@ -0,0 +1,5 @@ +type = "f" +message = "Honor character literals in pipeline rules." + +pulls = ["24295"] +issues = ["24247"] diff --git a/graylog2-server/src/main/java/org/graylog/plugins/pipelineprocessor/parser/PipelineRuleParser.java b/graylog2-server/src/main/java/org/graylog/plugins/pipelineprocessor/parser/PipelineRuleParser.java index 2cbc47a908..06c38fe29c 100644 --- a/graylog2-server/src/main/java/org/graylog/plugins/pipelineprocessor/parser/PipelineRuleParser.java +++ b/graylog2-server/src/main/java/org/graylog/plugins/pipelineprocessor/parser/PipelineRuleParser.java @@ -511,10 +511,18 @@ public class PipelineRuleParser { exprs.put(ctx, expr); } + /** + * Handle chars like strings. + * There is no dedicated char type for Graylog rules and, strictly speaking, we should error out. But we have + * been silently allowing (and ignoring) chars for 10 years.To not break existing rules, we continue to allow + * them. Except now we actually honor the expression value. + */ @Override public void exitChar(RuleLangParser.CharContext ctx) { - // TODO - super.exitChar(ctx); + final String text = unescape(unquote(ctx.getText(), '\'')); + final StringExpression expr = new StringExpression(ctx.getStart(), text); + log.trace("CHAR: ctx {} => {}", ctx, expr); + exprs.put(ctx, expr); } @Override diff --git a/graylog2-server/src/test/java/org/graylog/plugins/pipelineprocessor/parser/PipelineRuleParserTest.java b/graylog2-server/src/test/java/org/graylog/plugins/pipelineprocessor/parser/PipelineRuleParserTest.java index 7edb7146be..aa52249dca 100644 --- a/graylog2-server/src/test/java/org/graylog/plugins/pipelineprocessor/parser/PipelineRuleParserTest.java +++ b/graylog2-server/src/test/java/org/graylog/plugins/pipelineprocessor/parser/PipelineRuleParserTest.java @@ -266,6 +266,16 @@ class PipelineRuleParserTest extends BaseParserTest { assertTrue(actionsTriggered.get()); } + @Test + void charLiteral() { + final Rule rule = parseRuleWithOptionalCodegen(); + Message message = messageFactory.createMessage("hello test", "source", DateTime.now(DateTimeZone.UTC)); + final Message processedMsg = evaluateRule(rule, message); + + assertNotNull(processedMsg); + assertEquals("x", processedMsg.getField("x")); + } + @Test void typedFieldAccess() throws Exception { final Rule rule = parseRuleWithOptionalCodegen(); diff --git a/graylog2-server/src/test/resources/org/graylog/plugins/pipelineprocessor/parser/charLiteral.txt b/graylog2-server/src/test/resources/org/graylog/plugins/pipelineprocessor/parser/charLiteral.txt new file mode 100644 index 0000000000..bd6e11d685 --- /dev/null +++ b/graylog2-server/src/test/resources/org/graylog/plugins/pipelineprocessor/parser/charLiteral.txt @@ -0,0 +1,6 @@ +rule "char_literal" +when + true +then + set_field(field: "x", value: 'x'); +end