Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 58de75f

Browse files
efd6efd6
committed
sdd_all: use triple-brace templating
The mustache templating system used by ingest pipelines has two levels of escaping available, not escaped (triple stache) and HTML escaped (double stache) — see man mustache[1] under "tag types: variables". This can lead to data corruption, particularly in cases where an operating system has chosen to use a character requiring escaping in its path syntax. [1]http://mustache.github.io/mustache.5.html [git-generate] for f in $( ( for p in $( yq 'select(.owner.github == "elastic/sec-deployment-and-devices")|.name' packages/**/manifest.yml \ | grep -v -- '---' ); do rg -l -g '*.yml' ": ('\{\{[^{][ .a-zA-Z0-9_]*[^}]}}'|\"\{\{[^{][ .a-zA-Z0-9_]*[^}]}}\")" packages/$p done )|grep "elasticsearch/ingest_pipeline"|sort|uniq ); do sed -i -r "s/: (['\"])\{\{([^{][ .a-zA-Z0-9_]*[^}])}}['\"]/: \1{{{\2}}}\1/g" $f done for p in $(git diff --name-only HEAD~1|cut -d/ -f1,2|sort|uniq); do ( cd $p elastic-package test pipeline -g elastic-package changelog add \ --description "Use triple-brace Mustache templating when referencing variables in ingest pipelines." \ --type bugfix \ --next patch \ --link #11286 )>/dev/null 2>&1 done
1 parent 27f35c8 commit 58de75f

File tree

98 files changed

+397
-292
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

98 files changed

+397
-292
lines changed

‎packages/bluecoat/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "0.17.3"
3+
changes:
4+
- description: Use triple-brace Mustache templating when referencing variables in ingest pipelines.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/11286
27
- version: "0.17.2"
38
changes:
49
- description: Changed owners

‎packages/bluecoat/data_stream/director/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ processors:
5353
ignore_missing: true
5454
- append:
5555
field: related.hosts
56-
value: '{{host.name}}'
56+
value: '{{{host.name}}}'
5757
allow_duplicates: false
5858
if: ctx.host?.name != null && ctx.host?.name != ''
5959
- remove:

‎packages/bluecoat/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 2.7.0
22
name: bluecoat
33
title: Blue Coat Director Logs (Deprecated)
4-
version: "0.17.2"
4+
version: "0.17.3"
55
description: Deprecated. Director is no longer supported.
66
categories: ["network", "security", "proxy_security"]
77
type: integration

‎packages/cef/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.17.3"
3+
changes:
4+
- description: Use triple-brace Mustache templating when referencing variables in ingest pipelines.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/11286
27
- version: "2.17.2"
38
changes:
49
- description: Make dataset name configurable

‎packages/cef/data_stream/log/elasticsearch/ingest_pipeline/cp-pipeline.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -279,8 +279,8 @@ processors:
279279
field: _tmp_copy
280280
processor:
281281
set:
282-
field: '{{_ingest._value.to}}'
283-
value: '{{_ingest._value.value}}'
282+
field: '{{{_ingest._value.to}}}'
283+
value: '{{{_ingest._value.value}}}'
284284
- remove:
285285
field: _tmp_copy
286286
- set:

‎packages/cef/data_stream/log/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -57,46 +57,46 @@ processors:
5757
if: ctx?.cef?.extensions?.fileHash != null && ctx?.cef?.extensions?.fileHash != ''
5858
field: related.hash
5959
allow_duplicates: false
60-
value: '{{cef.extensions.fileHash}}'
60+
value: '{{{cef.extensions.fileHash}}}'
6161
- append:
6262
if: ctx?.cef?.extensions?.oldFileHash != null && ctx?.cef?.extensions?.oldFileHash != ''
6363
field: related.hash
6464
allow_duplicates: false
65-
value: '{{cef.extensions.oldFileHash}}'
65+
value: '{{{cef.extensions.oldFileHash}}}'
6666
- append:
6767
if: ctx?.destination?.ip != null && ctx?.destination?.ip != ''
6868
field: related.ip
6969
allow_duplicates: false
70-
value: '{{destination.ip}}'
70+
value: '{{{destination.ip}}}'
7171
- append:
7272
if: ctx?.destination?.nat?.ip != null && ctx?.destination?.nat?.ip != ''
7373
field: related.ip
7474
allow_duplicates: false
75-
value: '{{destination.nat.ip}}'
75+
value: '{{{destination.nat.ip}}}'
7676
- append:
7777
if: ctx?.source?.ip != null && ctx?.source?.ip != ''
7878
field: related.ip
7979
allow_duplicates: false
80-
value: '{{source.ip}}'
80+
value: '{{{source.ip}}}'
8181
- append:
8282
if: ctx?.source?.nat?.ip != null && ctx?.source?.nat?.ip != ''
8383
field: related.ip
8484
allow_duplicates: false
85-
value: '{{source.nat.ip}}'
85+
value: '{{{source.nat.ip}}}'
8686
- append:
8787
if: ctx?.destination?.user?.name != null
8888
field: related.user
89-
value: '{{destination.user.name}}'
89+
value: '{{{destination.user.name}}}'
9090
- append:
9191
if: ctx?.source?.user?.name != null && ctx?.source?.user?.name != ''
9292
field: related.user
9393
allow_duplicates: false
94-
value: '{{source.user.name}}'
94+
value: '{{{source.user.name}}}'
9595
- append:
9696
if: ctx?.observer?.hostname != null && ctx?.observer?.hostname != ''
9797
field: related.hosts
9898
allow_duplicates: false
99-
value: '{{observer.hostname}}'
99+
value: '{{{observer.hostname}}}'
100100
- pipeline:
101101
if: ctx.cef?.device?.vendor == 'FORCEPOINT'
102102
name: '{{ IngestPipeline "fp-pipeline" }}'
@@ -173,7 +173,7 @@ processors:
173173
if: ctx._tmp?.observer != null && ctx.observer?.ip == null
174174
field: observer.ip
175175
tag: observer append
176-
value: '{{_tmp.observer}}'
176+
value: '{{{_tmp.observer}}}'
177177
# Set ECS event outcome from ArcSight outcomes
178178
- set:
179179
if: ctx.cef?.extensions?.categoryOutcome == "/Success"

‎packages/cef/data_stream/log/elasticsearch/ingest_pipeline/fp-pipeline.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,22 +5,22 @@ processors:
55
- set:
66
field: rule.id
77
ignore_empty_value: true
8-
value: '{{cef.extensions.deviceCustomString1}}'
8+
value: '{{{cef.extensions.deviceCustomString1}}}'
99
# cs2 is natRuleID
1010
- set:
1111
field: rule.id
1212
ignore_empty_value: true
13-
value: '{{cef.extensions.deviceCustomString2}}'
13+
value: '{{{cef.extensions.deviceCustomString2}}}'
1414
# cs3 is VulnerabilityReference
1515
- set:
1616
field: vulnerability.reference
1717
ignore_empty_value: true
18-
value: '{{cef.extensions.deviceCustomString3}}'
18+
value: '{{{cef.extensions.deviceCustomString3}}}'
1919
# cs4 is virusID
2020
- set:
2121
field: cef.forcepoint.virus_id
2222
ignore_empty_value: true
23-
value: '{{cef.extensions.deviceCustomString4}}'
23+
value: '{{{cef.extensions.deviceCustomString4}}}'
2424
on_failure:
2525
- append:
2626
field: error.message

‎packages/cef/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: cef
22
title: Common Event Format (CEF)
3-
version: "2.17.2"
3+
version: "2.17.3"
44
description: Collect logs from CEF Logs with Elastic Agent.
55
categories:
66
- security

‎packages/checkpoint/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.34.1"
3+
changes:
4+
- description: Use triple-brace Mustache templating when referencing variables in ingest pipelines.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/11286
27
- version: "1.34.0"
38
changes:
49
- description: Drop support for EOL OS version R80.X

‎packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint-with-time.log-expected.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,7 @@
208208
"zone": "External"
209209
},
210210
"name": "172.16.2.9",
211-
"product": "VPN-1 \\\\u0026 FireWall-1",
211+
"product": "VPN-1 \\u0026 FireWall-1",
212212
"type": "firewall",
213213
"vendor": "Checkpoint"
214214
},
@@ -298,7 +298,7 @@
298298
"zone": "External"
299299
},
300300
"name": "172.16.2.9",
301-
"product": "VPN-1 \\\\u0026 FireWall-1",
301+
"product": "VPN-1 \\u0026 FireWall-1",
302302
"type": "firewall",
303303
"vendor": "Checkpoint"
304304
},

0 commit comments

Comments
 (0)