elastic / elastic/detection-rules

[Bug] [DaC] TOML string outputs are not properly escaped

Open
#5,182 4 comments 1 reaction 1 assignee Claimed by @eric-forte-elastic View on GitHub
bug community detections-as-code Team: TRADE
Dominant language
Python
Stars
2.7k
Forks
696
Avg merge
4d 17h
Merged PRs (30d)
87

Description

### Describe the Bug

When the triple double quotes are used to output raw strings is used, the TOML is not checked for escaped characters and the rendered output is

### To Reproduce

If I have a rule with a query DSL filter, that is sufficient long and an escaped character, this will cause the formatter to incorrectly output this as a raw string
```
{
"query_string": {
"query": "file.path: \"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\" file.path: Hello\\:World"
}
}
```

And the TOML will look like this
```

[[rule.filters]]

[rule.filters."$state"]
store = "appState"
[rule.filters.meta]
alias = "Custom Filter"
disabled = false
index = "apm-*-transaction*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,traces-apm*,winlogbeat-*,-*elastic-cloud-logs-*"
key = "query"
negate = false
type = "query_string"
value = 'file.path: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" file.path: Hello\:World'
[rule.filters.query.query_string]
query = """
file.path: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" file.path: Hello\:World
"""

```

### Expected Behavior

The output should always be escaped or the condition for `raw` should include checking for `\` characters.

https://github.com/elastic/detection-rules/blob/66a0b6b97c47957e5019d681943f4ff8ed3470ac/detection_rules/rule_formatter.py#L145

### Screenshots

## Screenshots

### Sample Filter
Image

### Corrupted TOML
Image

### Desktop - OS

None

### Desktop - Version

_No response_

### Additional Context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.