fix: fixed duplicate extrafieldinfo field to ScriptBlockText #1186

Yamato-Security · Oct 13, 2023 · f6e1c3b · f6e1c3b
1 parent 9c6d321
commit f6e1c3b
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 7 deletions.
diff --git a/src/detections/message.rs b/src/detections/message.rs
@@ -227,11 +227,12 @@ pub fn insert(
                 }
                 let record_details_info_ref = record_details_info_map.clone();
                 let profile_all_field_info_prof = record_details_info_ref.get("#AllFieldInfo");
-                let details_splits: HashSet<&str> = HashSet::from_iter(
-                    sp_removed_details_in_record_trim_newline
-                        .iter()
-                        .map(|x| x.split_once(": ").unwrap_or_default().1),
-                );
+                let details_splits: HashSet<&str> =
+                    HashSet::from_iter(sp_removed_details_in_record_trim_newline.iter().map(|x| {
+                        let v = x.split_once(": ").unwrap_or_default().1;
+                        // 末尾のカンマが含まれている場合と含まれていない場合でExtraFieldInfoでの一致判定が変わってしまうため判定用のハッシュセットの末尾のカンマを削除する
+                        v.strip_suffix(',').unwrap_or(v)
+                    }));
                 let profile_all_field_info = if let Some(all_field_info_val) =
                     profile_all_field_info_prof
                 {

diff --git a/src/detections/utils.rs b/src/detections/utils.rs
@@ -399,11 +399,11 @@ pub fn create_recordinfos(
                     convert_field_data(map, field_data_map_key, &key.to_lowercase(), value)
                 {
                     let val = remove_sp_char(converted_str, true);
-                    return format!("{key}: {val}").into();
+                    return format!("{key}: {}", val.strip_suffix(',').unwrap_or(&val)).into();
                 }
             }
             let val = remove_sp_char(value.into(), true);
-            format!("{key}: {val}").into()
+            format!("{key}: {}", val.strip_suffix(',').unwrap_or(&val)).into()
         })
         .collect()
 }