Skip to content

Condition expression values containing = characters must be quoted when printing asts #2323

@mstemm

Description

@mstemm

If a condition expression contains a value with a = character, when
the condition expression is printed as a string using
libsinsp::filter::ast::as_string, the value is not escaped.

This causes problems if you try to parse the condition expression string again.

For example, a condition of ... and not (proc.cmdline contains "--coreutils-prog-shebang=") and not ... gets printed as ... and not (proc.cmdline contains --coreutils-prog-shebang=) and not ... which results in an error when trying to parse it again:

LOAD_ERR_COMPILE_CONDITION (Error compiling condition): expected a ')' token
  • Falco version: 0.40.0
  • System info: { "machine": "aarch64", "nodename": "mstemm-ubuntu-lts", "release": "6.8.0-52-generic", "sysname": "Linux", "version": "#53-Ubuntu SMP PREEMPT_DYNAMIC Fri Jan 10 23:39:43 UTC 2025" }
  • Cloud provider or hardware configuration: This occurs regardless of where falco runs.
  • OS: PRETTY_NAME="Ubuntu 24.04.1 LTS" NAME="Ubuntu" VERSION_ID="24.04" VERSION="24.04.1 LTS (Noble Numbat)" VERSION_CODENAME=noble ID=ubuntu ID_LIKE=debian HOME_URL="https://www.ubuntu.com/" SUPPORT_URL="https://help.ubuntu.com/" BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/" PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy" UBUNTU_CODENAME=noble LOGO=ubuntu-logo
  • Kernel: Linux mstemm-ubuntu-lts 6.8.0-52-generic #53-Ubuntu SMP PREEMPT_DYNAMIC Fri Jan 10 23:39:43 UTC 2025 aarch64 aarch64 aarch64 GNU/Linux
  • Installation method: I built from source, the problem will occur anywhere.

Metadata

Metadata

Assignees

Labels

kind/bugSomething isn't working

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions