Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chg: output agg condition's JSON result as Details's child element #1354

Merged
merged 2 commits into from
May 27, 2024
Merged

chg: output agg condition's JSON result as Details's child element #1354

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2ac27fa
chg: output agg result as details child element
fukusuket May 26, 2024
7f1387b
update changelog
YamatoSecurity May 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
90 changes: 53 additions & 37 deletions src/afterfact.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1886,48 +1886,43 @@ pub fn output_json_str(
continue;
}
let details_target_stock = details_target_stocks.unwrap();
// aggregation conditionの場合は分解せずにそのまま出力する
if detect_info.is_condition {
let details_val =
if details_target_stock.is_empty() || details_target_stock[0] == "-" {
"-".into()
} else {
details_target_stock[0].clone()
};
output_stock.push(_create_json_output_format(
key,
&details_val,
key.starts_with('\"'),
details_val.starts_with('\"'),
4,
));
if jsonl_output_flag {
target.push(output_stock.join(""));
} else {
target.push(output_stock.join("\n"));
}
continue;
} else {
output_stock.push(format!(" \"{key}\": {{"));
};
let mut children_output_stock: HashMap<CompactString, Vec<CompactString>> =
HashMap::new();
let mut children_output_order = vec![];
for contents in details_target_stock.iter() {
let (key, value) = contents.split_once(':').unwrap_or_default();
let output_key = _convert_valid_json_str(&[key.trim()], false);
let fmted_val = _convert_valid_json_str(&[value.trim()], false);
if let RawEntryMut::Vacant(_) = children_output_stock
.raw_entry_mut()
.from_key(output_key.as_str())
{
children_output_order.push(output_key.clone());
if detect_info.is_condition {
if details_target_stock[0] == "-" {
output_stock.push(_create_json_output_format(
key,
details_target_stock[0].as_str(),
key.starts_with('\"'),
details_target_stock[0].starts_with('\"'),
4,
));
if jsonl_output_flag {
target.push(output_stock.join(""));
} else {
target.push(output_stock.join("\n"));
}
continue;
}
children_output_stock
.entry(output_key.into())
.or_insert(vec![])
.push(fmted_val.into());
let splitted_agg_details = details_target_stock[0]
.split(" ¦ ")
.map(|x| x.into())
.collect_vec();
process_target_stock(
&splitted_agg_details,
&mut children_output_stock,
&mut children_output_order,
);
} else {
process_target_stock(
details_target_stock,
&mut children_output_stock,
&mut children_output_order,
);
}
output_stock.push(format!(" \"{key}\": {{"));

// ルール内での表示順に合わせた表示順を戻した配列
let mut sorted_children_output_stock: Vec<(
&CompactString,
Expand Down Expand Up @@ -2062,6 +2057,27 @@ pub fn output_json_str(
}
}

fn process_target_stock(
details_target_stock: &[CompactString],
children_output_stock: &mut HashMap<CompactString, Vec<CompactString>>,
children_output_order: &mut Vec<CompactString>,
) {
for contents in details_target_stock.iter() {
let (key, value) = contents.split_once(':').unwrap_or_default();
let output_key = _convert_valid_json_str(&[key.trim()], false);
let fmted_val = _convert_valid_json_str(&[value.trim()], false);
if let RawEntryMut::Vacant(_) = children_output_stock
.raw_entry_mut()
.from_key(output_key.as_str())
{
children_output_order.push(output_key.clone().into());
}
children_output_stock
.entry(output_key.into())
.or_insert(vec![])
.push(fmted_val.into());
}
}
/// output detected rule author name function.
fn output_detected_rule_authors(
rule_author_counter: &HashMap<CompactString, i128>,
Expand Down
Loading