Graylog2 / Graylog2/graylog2-server
Incorrect Syslog RFC5424 Structured Data parsing
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
When we send structured data over a syslog connection, backslash character is deleted (even if escaped by another backslash).
## Expected Behavior
Escaped backslashes (ie. \\\\) should be correctly interpreted as a single backslash
RFC5424
Inside PARAM-VALUE, the characters '"' (ABNF %d34), '\\' (ABNF %d92), and ']' (ABNF %d93) MUST be escaped. This is necessary to avoid parsing errors. Escaping ']' would not strictly be necessary but is REQUIRED by this specification to avoid syslog application implementation errors. Each of these three characters MUST be escaped as '\\"', '\\\\', and '\\]' respectively.
The backslash is used for control character escaping for consistency with its use for escaping in other parts of the syslog message as well as in traditional syslog.
A backslash ('\\') followed by none of the three described characters is considered an invalid escape sequence. In this case, the backslash MUST be treated as a regular backslash and the following character as a regular character. Thus, the invalid sequence MUST not be altered.
## Current Behavior
Regardless of the number of backslashes we send in a structured data, they are deleted.
Ie. "C:\\\\Program Files\\\\MyFile" becomes "C:Program FilesMyFile"
Ie. "C:\\Program Files\\MyFile" becomes "C:Program FilesMyFile"
## Possible Solution
No workaround has been found yet
## Steps to Reproduce (for bugs)
Send RFC5424 structured data that contains \\ or \\\\ characters.
## Context
Receive fully compliant RFC5424 syslog messages
## Your Environment
* Graylog Version: v5.2.3 but also seen in v4.x
* Java Version: Graylog container
* OpenSearch Version: 2.11.1
* MongoDB Version: 5.0.23
* Operating System: Graylog container
* Browser version: Chromium 123
## Possible cause
In https://github.com/graylog-labs/syslog4j-graylog2/blob/master/src/main/java/org/graylog2/syslog4j/impl/message/structured/StructuredSyslogMessage.java#L348, I see a function **'unescape'** that removes all backslashes.
Contributor guide
Assessment
This issue has not been assessed yet.