remove comma to avoid to split the strings and confuse the search

Signed-off-by: Thomas Labarussias <issif+github@gadz.org>
falcosecurity · Apr 30, 2024 · 01947af · 01947af
1 parent fba1b77
commit 01947af
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/internal/database/redis/set.go b/internal/database/redis/set.go
@@ -39,7 +39,7 @@ func SetKey(client *redisearch.Client, event *models.Event) error {
 	doc := redisearch.NewDocument(fmt.Sprintf("event:%v", event.UUID), 1.0).
 		Set("rule", event.Rule).
 		Set("priority", event.Priority).
-		Set("output", utils.Escape(event.Output)).
+		Set("output", strings.ReplaceAll(utils.Escape(event.Output), ",", "")).
 		Set("source", event.Source).
 		Set("timestamp", event.Time.UnixNano()/1e3).
 		Set("tags", utils.Escape(strings.Join(event.Tags, ","))).

diff --git a/internal/utils/utils.go b/internal/utils/utils.go
@@ -167,7 +167,7 @@ func GetPriortiyInt(prio string) int {
 
 func Escape(s string) string {
 	s = strings.ReplaceAll(s, ".", `\.`)
-	s = strings.ReplaceAll(s, ",", "\\,")
+	// s = strings.ReplaceAll(s, ",", "\\,")
 	s = strings.ReplaceAll(s, "<", "\\<")
 	s = strings.ReplaceAll(s, ">", "\\>")
 	s = strings.ReplaceAll(s, "{", "\\{")
@@ -196,8 +196,8 @@ func Escape(s string) string {
 }
 
 func UnEscape(s string) string {
-	s = strings.ReplaceAll(s, "\\,", ",")
 	s = strings.ReplaceAll(s, `\.`, ".")
+	// s = strings.ReplaceAll(s, "\\,", ",")
 	s = strings.ReplaceAll(s, "\\<", "<")
 	s = strings.ReplaceAll(s, "\\>", ">")
 	s = strings.ReplaceAll(s, "\\{", "{")