valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 01:45:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fixed escaping of \u in Elasticsearch Query String queries

Browse Source
This commit is contained in:
Thomas Patzke 2018-05-01 00:05:16 +02:00
parent 15a6c5efb5
commit e411039b56
2 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
tests/test-backend-es-qs.py
View File

@ -86,7 +86,6 @@ async def check_queries():
try: try:
detail_result = await esa.search(index=index, q=query) detail_result = await esa.search(index=index, q=query)
except Exception as e: except Exception as e:
#error = e.info['error']['root_cause']
error = e.info error = e.info
failed.append((rule, query, error)) failed.append((rule, query, error))

2
tools/sigma/backends.py
View File

@ -304,7 +304,7 @@ class ElasticsearchQuerystringBackend(SingleTextQueryBackend):
identifier = "es-qs" identifier = "es-qs"
active = True active = True
reEscape = re.compile("([+\\-=!(){}\\[\\]^\"~:/]|\\\\(!>[*?])|&&|\\|\\|)") reEscape = re.compile("([+\\-=!(){}\\[\\]^\"~:/]|\\\\(!>[*?])|\\\\u|&&|\\|\\|)")
reClear = re.compile("[<>]") reClear = re.compile("[<>]")
andToken = " AND " andToken = " AND "
orToken = " OR " orToken = " OR "