fix: fixed #1189

Yamato-Security · Oct 13, 2023 · 2fc78ce · 2fc78ce
1 parent 9c6d321
commit 2fc78ce
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 24 deletions.
diff --git a/src/detections/message.rs b/src/detections/message.rs
@@ -127,7 +127,6 @@ pub fn insert(
     ),
 ) {
     let mut record_details_info_map = HashMap::new();
-    let mut sp_removed_details_in_record_trim_newline = vec![];
     if !is_agg {
         //ここの段階でdetailsの内容でaliasを置き換えた内容と各種、key,valueの組み合わせのmapを取得する
         let (removed_sp_parsed_detail, details_in_record) = parse_message(
@@ -141,13 +140,12 @@ pub fn insert(
 
         let mut sp_removed_details_in_record = vec![];
         details_in_record.iter().for_each(|v| {
-            sp_removed_details_in_record.push(remove_sp_char(v.clone(), true));
-            sp_removed_details_in_record_trim_newline.push(remove_sp_char(v.clone(), false));
+            sp_removed_details_in_record.push(remove_sp_char(v.clone()));
         });
         record_details_info_map.insert("#Details".into(), sp_removed_details_in_record);
         // 特殊文字の除外のためのretain処理
         // Details内にある改行文字は除外しないために絵文字を含めた特殊な文字に変換することで対応する
-        let parsed_detail = remove_sp_char(removed_sp_parsed_detail, true);
+        let parsed_detail = remove_sp_char(removed_sp_parsed_detail);
         detect_info.detail = if parsed_detail.is_empty() {
             CompactString::from("-")
         } else {
@@ -227,8 +225,11 @@ pub fn insert(
                 }
                 let record_details_info_ref = record_details_info_map.clone();
                 let profile_all_field_info_prof = record_details_info_ref.get("#AllFieldInfo");
+                let empty = vec![];
                 let details_splits: HashSet<&str> = HashSet::from_iter(
-                    sp_removed_details_in_record_trim_newline
+                    record_details_info_ref
+                        .get("#Details")
+                        .unwrap_or(&empty)
                         .iter()
                         .map(|x| x.split_once(": ").unwrap_or_default().1),
                 );

diff --git a/src/detections/utils.rs b/src/detections/utils.rs
@@ -398,11 +398,11 @@ pub fn create_recordinfos(
                 if let Some(converted_str) =
                     convert_field_data(map, field_data_map_key, &key.to_lowercase(), value)
                 {
-                    let val = remove_sp_char(converted_str, true);
+                    let val: CompactString = remove_sp_char(converted_str);
                     return format!("{key}: {val}").into();
                 }
             }
-            let val = remove_sp_char(value.into(), true);
+            let val = remove_sp_char(value.into());
             format!("{key}: {val}").into()
         })
         .collect()
@@ -449,7 +449,9 @@ fn _collect_recordinfo<'a>(
             let strval = value_to_string(value);
             if let Some(strval) = strval {
                 let strval = strval.trim().chars().fold(String::default(), |mut acc, c| {
-                    if c.is_control() || c.is_ascii_whitespace() {
+                    if (c.is_control() || c.is_ascii_whitespace())
+                        && !['\r', '\n', '\t'].contains(&c)
+                    {
                         acc.push(' ');
                     } else {
                         acc.push(c);
@@ -692,22 +694,11 @@ pub fn output_duration(d: Duration) -> String {
     format!("{h:02}:{m:02}:{s:02}.{ms:03}")
 }
 
-pub fn remove_sp_char(record_value: CompactString, remain_newline: bool) -> CompactString {
-    let mut newline_replaced_cs: String = if remain_newline {
-        record_value
-            .replace('\n', "🛂n")
-            .replace('\r', "🛂r")
-            .replace('\t', "🛂t")
-    } else {
-        record_value.chars().fold(String::default(), |mut acc, c| {
-            if c.is_control() || c.is_ascii_whitespace() {
-                acc.push(' ');
-            } else {
-                acc.push(c);
-            };
-            acc
-        })
-    };
+pub fn remove_sp_char(record_value: CompactString) -> CompactString {
+    let mut newline_replaced_cs: String = record_value
+        .replace('\n', "🛂n")
+        .replace('\r', "🛂r")
+        .replace('\t', "🛂t");
     let mut prev = 'a';
     newline_replaced_cs.retain(|ch| {
         let retain_flag = (prev == ' ' && ch == ' ') || ch.is_control();