Skip to content

chore(userspace/libsinsp): escape equals ast values #2324

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Mar 24, 2025
Merged

chore(userspace/libsinsp): escape equals ast values #2324

merged 2 commits into from
Mar 24, 2025

Conversation

mstemm
Copy link
Contributor

@mstemm mstemm commented Mar 21, 2025 •
edited by FedeDP
Loading

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

Any specific area of the project related to this PR?

/area libsinsp

Does this PR require a change in the driver versions?

No.

What this PR does / why we need it:

Properly escape = characters in condition expressions when printing the condition as a string.

Which issue(s) this PR fixes:

Fixes #2323

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

no

chore(userspace/libsinsp): properly escape `=` characters in condition expressions when printing the condition as a string.

mstemm added 2 commits March 21, 2025 11:26
@mstemm
fix(libsinsp): Escape values containing = characters
a555a29 
If a condition expression contains a value with a = character, when
the condition expression is printed as a string using
libsinsp::filter::ast::as_string, the value is not escaped.

This causes problems if you try to parse the condition expression string again.

For example, a condition of ... and not (proc.cmdline contains
"--coreutils-prog-shebang=") and not ... gets printed as ... and
not (proc.cmdline contains --coreutils-prog-shebang=) and not
... which results in an error when trying to parse it again.

The fix is to detect when a value contains a `=` character and escape
the value when found.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
@mstemm
Add a unit test for escaping values containing = characters
5e65b1b 
This test verifies that a condition expression with a value containing
an `=` character can be printed and parsed again without errors.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
@poiana poiana requested review from hbrueckner and leogr March 21, 2025 18:30
@codecov Codecov
Copy link

codecov bot commented Mar 21, 2025 •
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 77.17%. Comparing base (98970de) to head (5e65b1b).
Report is 3 commits behind head on master.

Additional details and impacted files 
@@           Coverage Diff           @@
##           master    #2324   +/-   ##
=======================================
  Coverage   77.16%   77.17%           
=======================================
  Files         226      226           
  Lines       30161    30169    +8     
  Branches     4611     4611           
=======================================
+ Hits        23274    23282    +8     
  Misses       6887     6887
Flag Coverage Δ
libsinsp 77.17% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@github-actions GitHub Actions
Copy link

Perf diff from master - unit tests

     6.46%     -0.67%  [.] sinsp_parser::reset
     4.46%     -0.51%  [.] sinsp_thread_manager::find_thread
     0.88%     +0.34%  [.] libsinsp::sinsp_suppress::process_event
     6.01%     +0.33%  [.] sinsp::next
     2.10%     +0.32%  [.] sinsp_evt::load_params
     1.08%     +0.28%  [.] user_group_updater::~user_group_updater
     0.98%     +0.25%  [.] sinsp::fetch_next_event
     0.97%     +0.25%  [.] user_group_updater::user_group_updater
     1.09%     -0.24%  [.] scap_event_decode_params
     0.23%     +0.23%  [.] scap_next

Heap diff from master - unit tests

peak heap memory consumption: -401B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            -0.0214         -0.0214           147           144           147           144
BM_sinsp_split_median                                          -0.0286         -0.0286           148           143           148           143
BM_sinsp_split_stddev                                          -0.0361         -0.0363             2             2             2             2
BM_sinsp_split_cv                                              -0.0150         -0.0153             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  +0.0442         +0.0442            52            54            52            54
BM_sinsp_concatenate_paths_relative_path_median                +0.0421         +0.0421            51            53            51            53
BM_sinsp_concatenate_paths_relative_path_stddev                -0.0562         -0.0557             1             1             1             1
BM_sinsp_concatenate_paths_relative_path_cv                    -0.0961         -0.0956             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     -0.0076         -0.0076            25            25            25            25
BM_sinsp_concatenate_paths_empty_path_median                   -0.0083         -0.0083            25            25            25            25
BM_sinsp_concatenate_paths_empty_path_stddev                   -0.7005         -0.6995             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_cv                       -0.6982         -0.6971             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  -0.0037         -0.0037            51            51            51            51
BM_sinsp_concatenate_paths_absolute_path_median                +0.0037         +0.0037            51            51            51            51
BM_sinsp_concatenate_paths_absolute_path_stddev                -0.3925         -0.3925             1             1             1             1
BM_sinsp_concatenate_paths_absolute_path_cv                    -0.3902         -0.3903             0             0             0             0

@FedeDP
Copy link
Contributor

FedeDP commented Mar 24, 2025

/milestone 0.21.0
/cc @jasondellaluce

@poiana poiana requested a review from jasondellaluce March 24, 2025 07:51
@poiana poiana added this to the 0.21.0 milestone Mar 24, 2025
@poiana poiana added the lgtm label Mar 24, 2025
@poiana
Copy link
Contributor

poiana commented Mar 24, 2025

LGTM label has been added.

Git tree hash: 0c516c6673679566efb06f6dd2111123a254ebfa

FedeDP
FedeDP approved these changes Mar 24, 2025
View reviewed changes
Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@github-project-automation github-project-automation bot moved this from Todo to In progress in Falco Roadmap Mar 24, 2025
@poiana
Copy link
Contributor

poiana commented Mar 24, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP, mstemm

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit ab8e6cb into master Mar 24, 2025
47 checks passed
@poiana poiana deleted the escape-equals-ast-values branch March 24, 2025 10:11
@github-project-automation github-project-automation bot moved this from In progress to Done in Falco Roadmap Mar 24, 2025
@FedeDP FedeDP changed the title Escape equals ast values chore(userspace/libsinsp): escape equals ast values Apr 22, 2025
@bevanjkay bevanjkay mentioned this pull request May 20, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@FedeDP FedeDP FedeDP approved these changes

@jasondellaluce jasondellaluce jasondellaluce approved these changes

@hbrueckner hbrueckner Awaiting requested review from hbrueckner

@leogr leogr Awaiting requested review from leogr

Assignees

@FedeDP FedeDP

@jasondellaluce jasondellaluce

Labels
approved area/libsinsp dco-signoff: yes kind/bug Something isn't working lgtm release-note size/S
Projects
Falco Roadmap
Archived in project
Milestone
0.21.0
Development

Successfully merging this pull request may close these issues.

Condition expression values containing = characters must be quoted when printing asts
4 participants
@mstemm @FedeDP @poiana @jasondellaluce