Skip to content

[CALCITE-3067] Splunk Calcite adapter cannot parse right session keys from Splunk 7.2 #1218

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from

Conversation

LastSmile732
Copy link
Contributor

Fix the regular expression for parsing session keys from Splunk 7.2+

@@ -58,7 +58,7 @@

private static final Pattern SESSION_KEY =
Pattern.compile(
"<response>\\s*<sessionKey>([0-9a-f]+)</sessionKey>\\s*</response>");
"<sessionKey>(.+)<\\/sessionKey>");
Copy link
Member

@zhztheplayer zhztheplayer May 18, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not familiar with Splunk's session yet, however as the implementation of Regex sign + in Java is based on longest matching, I am not sure if it's safe enough to use .+ here. Is ([0-9a-f]+) not able to match the content in this case?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The session key from Splunk contains numbers, a-z in both lower and upper cases, also there are special characters such as ^ and _. So ([0-9a-f]+) could not match connections from the latest version of Splunk. Is ([0-9a-zA-Z^_]+) acceptable in case of safety?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, please use that one. Thanks for your explanation. :)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No problem, I will close this pull request first.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you meant to change the PR, you can update your own source branch https://github.com/LastSmile732/calcite/tree/CALCITE-3067 then the PR should be able to sync the changes automatically. This way you don't have to close and file a new one.

@zhztheplayer
Copy link
Member

Also, please add and verify the email address used in your commit on GitHub. See the https://help.github.com/en/articles/verifying-your-email-address.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants