honeymoose/OpenSearch
1
0
Fork 0
mirror of https://github.com/honeymoose/OpenSearch.git synced 2025-02-13 08:25:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

EQL: Replace ?"..." with """...""" for unescaped strings (#62539) (#63174)

Browse Source 
Use triple double quotes enclosing a string literal to interpret it
as unescaped, in order to use `?` for marking query params and avoid
user confusion. `?` also usually implies regex expressions.

Any character inside the `"""` beginning-closing markings is considered
raw and the only thing that is not permitted is the `"""` sequence itself.
If a user wants to use that, needs to resort to the normal `"` string literal
and use proper escaping.

Relates to #61659

(cherry picked from commit d87c2ca2eacab5552bca1e520d33cf71da40bcfd)
This commit is contained in:
Marios Trivyzas 2020-10-02 14:58:50 +02:00 committed by GitHub
parent cfcf973259
commit 7d74fb8577
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
8 changed files with 245 additions and 158 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
x-pack/plugin/eql/qa/common/src/main/resources/additional_test_queries.toml
View File

@ -138,15 +138,15 @@ expected_event_ids = [98]
notes = "regexp doesn't support character classes" notes = "regexp doesn't support character classes"
query = ''' query = '''
// //
// ?".*?net1\s+localgroup.*?") // """.*?net1\s+localgroup.*?""")
process where match(command_line, ?".*?net1[ ]+localgroup.*?") process where match(command_line, """.*?net1[ ]+localgroup.*?""")
''' '''
[[queries]] [[queries]]
name = "matchLiteAdditional" name = "matchLiteAdditional"
expected_event_ids = [98] expected_event_ids = [98]
query = ''' query = '''
process where matchLite(command_line, ?".*?net1.*?") process where matchLite(command_line, """.*?net1.*?""")
''' '''
[[queries]] [[queries]]
@ -154,8 +154,8 @@ name = "matchWithCharacterClasses2"
expected_event_ids = [98] expected_event_ids = [98]
notes = "regexp doesn't support predefined character classes (like \\s)" notes = "regexp doesn't support predefined character classes (like \\s)"
query = ''' query = '''
// ?".*?net1\s+\w{4,15}\s+.*?" // """.*?net1\s+\w{4,15}\s+.*?"""
process where match(command_line, ?".*?net1[ ]+[a-z]{4,15}[ ]+.*?") process where match(command_line, """.*?net1[ ]+[a-z]{4,15}[ ]+.*?""")
''' '''

10
x-pack/plugin/eql/qa/common/src/main/resources/test_queries.toml
View File

@ -1399,21 +1399,21 @@ registry where bytes_written_string_list[1] : "en"
[[queries]] [[queries]]
name = "matchLite1" name = "matchLite1"
query = ''' query = '''
process where matchLite(command_line, ?".*?net1\s+localgroup\s+.*?") process where matchLite(command_line, """.*?net1\s+localgroup\s+.*?""")
''' '''
expected_event_ids = [98] expected_event_ids = [98]
[[queries]] [[queries]]
name = "matchLite2" name = "matchLite2"
query = ''' query = '''
process where matchLite(command_line, ?".*?net1\s+\w+\s+.*?") process where matchLite(command_line, """.*?net1\s+\w+\s+.*?""")
''' '''
expected_event_ids = [98] expected_event_ids = [98]
[[queries]] [[queries]]
name = "matchLite3" name = "matchLite3"
query = ''' query = '''
process where matchLite(command_line, ?".*?net1\s+\w{4,15}\s+.*?") process where matchLite(command_line, """.*?net1\s+\w{4,15}\s+.*?""")
''' '''
expected_event_ids = [98] expected_event_ids = [98]
@ -1421,13 +1421,13 @@ expected_event_ids = [98]
name = "match1" name = "match1"
expected_event_ids = [98] expected_event_ids = [98]
query = ''' query = '''
process where match(command_line, ?".*?net1\s+\w{4,15}\s+.*?") process where match(command_line, """.*?net1\s+\w{4,15}\s+.*?""")
''' '''
[[queries]] [[queries]]
name = "matchLite4" name = "matchLite4"
query = ''' query = '''
process where matchLite(command_line, ?".*?net1\s+[localgrup]{4,15}\s+.*?") process where matchLite(command_line, """.*?net1\s+[localgrup]{4,15}\s+.*?""")
''' '''
expected_event_ids = [98] expected_event_ids = [98]

10
x-pack/plugin/eql/qa/common/src/main/resources/test_queries_unsupported.toml
View File

@ -797,21 +797,21 @@ registry where bytes_written_string_list[1] : "en"
[[queries]] [[queries]]
name = "matchLite1" name = "matchLite1"
query = ''' query = '''
process where matchLite(command_line, ?".*?net1\s+localgroup\s+.*?") process where matchLite(command_line, """.*?net1\s+localgroup\s+.*?""")
''' '''
expected_event_ids = [98] expected_event_ids = [98]
[[queries]] [[queries]]
name = "matchLite2" name = "matchLite2"
query = ''' query = '''
process where matchLite(command_line, ?".*?net1\s+\w+\s+.*?") process where matchLite(command_line, """.*?net1\s+\w+\s+.*?""")
''' '''
expected_event_ids = [98] expected_event_ids = [98]
[[queries]] [[queries]]
name = "matchLite3" name = "matchLite3"
query = ''' query = '''
process where matchLite(command_line, ?".*?net1\s+\w{4,15}\s+.*?") process where matchLite(command_line, """.*?net1\s+\w{4,15}\s+.*?""")
''' '''
expected_event_ids = [98] expected_event_ids = [98]
@ -819,13 +819,13 @@ expected_event_ids = [98]
name = "match1" name = "match1"
expected_event_ids = [98] expected_event_ids = [98]
query = ''' query = '''
process where match(command_line, ?".*?net1\s+\w{4,15}\s+.*?") process where match(command_line, """.*?net1\s+\w{4,15}\s+.*?""")
''' '''
[[queries]] [[queries]]
name = "matchLite4" name = "matchLite4"
query = ''' query = '''
process where matchLite(command_line, ?".*?net1\s+[localgrup]{4,15}\s+.*?") process where matchLite(command_line, """.*?net1\s+[localgrup]{4,15}\s+.*?""")
''' '''
expected_event_ids = [98] expected_event_ids = [98]

1
x-pack/plugin/eql/src/main/antlr/EqlBase.g4
View File

@ -202,6 +202,7 @@ STRING
| '"' ('\\' [btnfr"'\\] | ~[\r\n"\\])* '"' | '"' ('\\' [btnfr"'\\] | ~[\r\n"\\])* '"'
| '?"' ('\\"' |~["\r\n])* '"' | '?"' ('\\"' |~["\r\n])* '"'
| '?\'' ('\\\'' |~['\r\n])* '\'' | '?\'' ('\\\'' |~['\r\n])* '\''
| '"""' (~[\r\n])*? '"""' '"'? '"'?
; ;
INTEGER_VALUE INTEGER_VALUE

11
x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/AbstractBuilder.java
View File

@ -122,10 +122,15 @@ abstract class AbstractBuilder extends EqlBaseBaseVisitor<Object> {
return null; return null;
} }
// unescaped strings can be interpreted directly // catch old method of ?" and ?' to define unescaped strings
if (text.startsWith("?")) { if (text.startsWith("?")) {
checkForSingleQuotedString(source, text, 1); throw new ParsingException(source,
return text.substring(2, text.length() - 1); "Use triple double quotes [\"\"\"] to define unescaped string literals, not [?{}]", text.charAt(1));
}
// unescaped strings can be interpreted directly
if (text.startsWith("\"\"\"")) {
return text.substring(3, text.length() - 3);
} }
checkForSingleQuotedString(source, text, 0); checkForSingleQuotedString(source, text, 0);

247
x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/EqlBaseLexer.java
View File

@ -106,7 +106,7 @@ class EqlBaseLexer extends Lexer {
public ATN getATN() { return _ATN; } public ATN getATN() { return _ATN; }
public static final String _serializedATN = public static final String _serializedATN =
"\3\u0430\ud6d1\u8206\uad2d\u4417\uaef1\u8d80\uaadd\2.\u0186\b\1\4\2\t"+ "\3\u0430\ud6d1\u8206\uad2d\u4417\uaef1\u8d80\uaadd\2.\u019a\b\1\4\2\t"+
"\2\4\3\t\3\4\4\t\4\4\5\t\5\4\6\t\6\4\7\t\7\4\b\t\b\4\t\t\t\4\n\t\n\4\13"+ "\2\4\3\t\3\4\4\t\4\4\5\t\5\4\6\t\6\4\7\t\7\4\b\t\b\4\t\t\t\4\n\t\n\4\13"+
"\t\13\4\f\t\f\4\r\t\r\4\16\t\16\4\17\t\17\4\20\t\20\4\21\t\21\4\22\t\22"+ "\t\13\4\f\t\f\4\r\t\r\4\16\t\16\4\17\t\17\4\20\t\20\4\21\t\21\4\22\t\22"+
"\4\23\t\23\4\24\t\24\4\25\t\25\4\26\t\26\4\27\t\27\4\30\t\30\4\31\t\31"+ "\4\23\t\23\4\24\t\24\4\25\t\25\4\26\t\26\4\27\t\27\4\30\t\30\4\31\t\31"+
@ -124,124 +124,133 @@ class EqlBaseLexer extends Lexer {
"\'\3\'\7\'\u00ec\n\'\f\'\16\'\u00ef\13\'\3\'\3\'\3\'\3\'\3\'\7\'\u00f6"+ "\'\3\'\7\'\u00ec\n\'\f\'\16\'\u00ef\13\'\3\'\3\'\3\'\3\'\3\'\7\'\u00f6"+
"\n\'\f\'\16\'\u00f9\13\'\3\'\3\'\3\'\3\'\3\'\3\'\3\'\7\'\u0102\n\'\f\'"+ "\n\'\f\'\16\'\u00f9\13\'\3\'\3\'\3\'\3\'\3\'\3\'\3\'\7\'\u0102\n\'\f\'"+
"\16\'\u0105\13\'\3\'\3\'\3\'\3\'\3\'\3\'\3\'\7\'\u010e\n\'\f\'\16\'\u0111"+ "\16\'\u0105\13\'\3\'\3\'\3\'\3\'\3\'\3\'\3\'\7\'\u010e\n\'\f\'\16\'\u0111"+
"\13\'\3\'\5\'\u0114\n\'\3(\6(\u0117\n(\r(\16(\u0118\3)\6)\u011c\n)\r)"+ "\13\'\3\'\3\'\3\'\3\'\3\'\3\'\7\'\u0119\n\'\f\'\16\'\u011c\13\'\3\'\3"+
"\16)\u011d\3)\3)\7)\u0122\n)\f)\16)\u0125\13)\3)\3)\6)\u0129\n)\r)\16"+ "\'\3\'\3\'\3\'\5\'\u0123\n\'\3\'\5\'\u0126\n\'\5\'\u0128\n\'\3(\6(\u012b"+
")\u012a\3)\6)\u012e\n)\r)\16)\u012f\3)\3)\7)\u0134\n)\f)\16)\u0137\13"+ "\n(\r(\16(\u012c\3)\6)\u0130\n)\r)\16)\u0131\3)\3)\7)\u0136\n)\f)\16)"+
")\5)\u0139\n)\3)\3)\3)\3)\6)\u013f\n)\r)\16)\u0140\3)\3)\5)\u0145\n)\3"+ "\u0139\13)\3)\3)\6)\u013d\n)\r)\16)\u013e\3)\6)\u0142\n)\r)\16)\u0143"+
"*\3*\5*\u0149\n*\3*\3*\3*\7*\u014e\n*\f*\16*\u0151\13*\3+\3+\5+\u0155"+ "\3)\3)\7)\u0148\n)\f)\16)\u014b\13)\5)\u014d\n)\3)\3)\3)\3)\6)\u0153\n"+
"\n+\3+\6+\u0158\n+\r+\16+\u0159\3,\3,\3-\3-\3.\3.\3.\3.\7.\u0164\n.\f"+ ")\r)\16)\u0154\3)\3)\5)\u0159\n)\3*\3*\5*\u015d\n*\3*\3*\3*\7*\u0162\n"+
".\16.\u0167\13.\3.\5.\u016a\n.\3.\5.\u016d\n.\3.\3.\3/\3/\3/\3/\3/\7/"+ "*\f*\16*\u0165\13*\3+\3+\5+\u0169\n+\3+\6+\u016c\n+\r+\16+\u016d\3,\3"+
"\u0176\n/\f/\16/\u0179\13/\3/\3/\3/\3/\3/\3\60\6\60\u0181\n\60\r\60\16"+ ",\3-\3-\3.\3.\3.\3.\7.\u0178\n.\f.\16.\u017b\13.\3.\5.\u017e\n.\3.\5."+
"\60\u0182\3\60\3\60\3\u0177\2\61\3\3\5\4\7\5\t\6\13\7\r\b\17\t\21\n\23"+ "\u0181\n.\3.\3.\3/\3/\3/\3/\3/\7/\u018a\n/\f/\16/\u018d\13/\3/\3/\3/\3"+
"\13\25\f\27\r\31\16\33\17\35\20\37\21!\22#\23%\24\'\25)\26+\27-\30/\31"+ "/\3/\3\60\6\60\u0195\n\60\r\60\16\60\u0196\3\60\3\60\4\u011a\u018b\2\61"+
"\61\32\63\33\65\34\67\359\36;\37= ?!A\"C#E$G%I&K\'M(O)Q*S+U\2W\2Y\2[,"+ "\3\3\5\4\7\5\t\6\13\7\r\b\17\t\21\n\23\13\25\f\27\r\31\16\33\17\35\20"+
"]-_.\3\2\17\3\2bb\n\2$$))^^ddhhppttvv\6\2\f\f\17\17))^^\6\2\f\f\17\17"+ "\37\21!\22#\23%\24\'\25)\26+\27-\30/\31\61\32\63\33\65\34\67\359\36;\37"+
"$$^^\5\2\f\f\17\17$$\5\2\f\f\17\17))\4\2BBaa\4\2GGgg\4\2--//\3\2\62;\4"+ "= ?!A\"C#E$G%I&K\'M(O)Q*S+U\2W\2Y\2[,]-_.\3\2\17\3\2bb\n\2$$))^^ddhhp"+
"\2C\\c|\4\2\f\f\17\17\5\2\13\f\17\17\"\"\u01a6\2\3\3\2\2\2\2\5\3\2\2\2"+ "pttvv\6\2\f\f\17\17))^^\6\2\f\f\17\17$$^^\5\2\f\f\17\17$$\5\2\f\f\17\17"+
"\2\7\3\2\2\2\2\t\3\2\2\2\2\13\3\2\2\2\2\r\3\2\2\2\2\17\3\2\2\2\2\21\3"+ "))\4\2\f\f\17\17\4\2BBaa\4\2GGgg\4\2--//\3\2\62;\4\2C\\c|\5\2\13\f\17"+
"\2\2\2\2\23\3\2\2\2\2\25\3\2\2\2\2\27\3\2\2\2\2\31\3\2\2\2\2\33\3\2\2"+ "\17\"\"\u01be\2\3\3\2\2\2\2\5\3\2\2\2\2\7\3\2\2\2\2\t\3\2\2\2\2\13\3\2"+
"\2\2\35\3\2\2\2\2\37\3\2\2\2\2!\3\2\2\2\2#\3\2\2\2\2%\3\2\2\2\2\'\3\2"+ "\2\2\2\r\3\2\2\2\2\17\3\2\2\2\2\21\3\2\2\2\2\23\3\2\2\2\2\25\3\2\2\2\2"+
"\2\2\2)\3\2\2\2\2+\3\2\2\2\2-\3\2\2\2\2/\3\2\2\2\2\61\3\2\2\2\2\63\3\2"+ "\27\3\2\2\2\2\31\3\2\2\2\2\33\3\2\2\2\2\35\3\2\2\2\2\37\3\2\2\2\2!\3\2"+
"\2\2\2\65\3\2\2\2\2\67\3\2\2\2\29\3\2\2\2\2;\3\2\2\2\2=\3\2\2\2\2?\3\2"+ "\2\2\2#\3\2\2\2\2%\3\2\2\2\2\'\3\2\2\2\2)\3\2\2\2\2+\3\2\2\2\2-\3\2\2"+
"\2\2\2A\3\2\2\2\2C\3\2\2\2\2E\3\2\2\2\2G\3\2\2\2\2I\3\2\2\2\2K\3\2\2\2"+ "\2\2/\3\2\2\2\2\61\3\2\2\2\2\63\3\2\2\2\2\65\3\2\2\2\2\67\3\2\2\2\29\3"+
"\2M\3\2\2\2\2O\3\2\2\2\2Q\3\2\2\2\2S\3\2\2\2\2[\3\2\2\2\2]\3\2\2\2\2_"+ "\2\2\2\2;\3\2\2\2\2=\3\2\2\2\2?\3\2\2\2\2A\3\2\2\2\2C\3\2\2\2\2E\3\2\2"+
"\3\2\2\2\3a\3\2\2\2\5e\3\2\2\2\7i\3\2\2\2\tl\3\2\2\2\13r\3\2\2\2\ru\3"+ "\2\2G\3\2\2\2\2I\3\2\2\2\2K\3\2\2\2\2M\3\2\2\2\2O\3\2\2\2\2Q\3\2\2\2\2"+
"\2\2\2\17z\3\2\2\2\21\u0082\3\2\2\2\23\u0086\3\2\2\2\25\u008b\3\2\2\2"+ "S\3\2\2\2\2[\3\2\2\2\2]\3\2\2\2\2_\3\2\2\2\3a\3\2\2\2\5e\3\2\2\2\7i\3"+
"\27\u008e\3\2\2\2\31\u0091\3\2\2\2\33\u009a\3\2\2\2\35\u009f\3\2\2\2\37"+ "\2\2\2\tl\3\2\2\2\13r\3\2\2\2\ru\3\2\2\2\17z\3\2\2\2\21\u0082\3\2\2\2"+
"\u00a5\3\2\2\2!\u00ab\3\2\2\2#\u00b0\3\2\2\2%\u00b2\3\2\2\2\'\u00b4\3"+ "\23\u0086\3\2\2\2\25\u008b\3\2\2\2\27\u008e\3\2\2\2\31\u0091\3\2\2\2\33"+
"\2\2\2)\u00b7\3\2\2\2+\u00ba\3\2\2\2-\u00bc\3\2\2\2/\u00bf\3\2\2\2\61"+ "\u009a\3\2\2\2\35\u009f\3\2\2\2\37\u00a5\3\2\2\2!\u00ab\3\2\2\2#\u00b0"+
"\u00c1\3\2\2\2\63\u00c4\3\2\2\2\65\u00c6\3\2\2\2\67\u00c8\3\2\2\29\u00ca"+ "\3\2\2\2%\u00b2\3\2\2\2\'\u00b4\3\2\2\2)\u00b7\3\2\2\2+\u00ba\3\2\2\2"+
"\3\2\2\2;\u00cc\3\2\2\2=\u00ce\3\2\2\2?\u00d0\3\2\2\2A\u00d2\3\2\2\2C"+ "-\u00bc\3\2\2\2/\u00bf\3\2\2\2\61\u00c1\3\2\2\2\63\u00c4\3\2\2\2\65\u00c6"+
"\u00d4\3\2\2\2E\u00d6\3\2\2\2G\u00d8\3\2\2\2I\u00da\3\2\2\2K\u00dc\3\2"+ "\3\2\2\2\67\u00c8\3\2\2\29\u00ca\3\2\2\2;\u00cc\3\2\2\2=\u00ce\3\2\2\2"+
"\2\2M\u0113\3\2\2\2O\u0116\3\2\2\2Q\u0144\3\2\2\2S\u0148\3\2\2\2U\u0152"+ "?\u00d0\3\2\2\2A\u00d2\3\2\2\2C\u00d4\3\2\2\2E\u00d6\3\2\2\2G\u00d8\3"+
"\3\2\2\2W\u015b\3\2\2\2Y\u015d\3\2\2\2[\u015f\3\2\2\2]\u0170\3\2\2\2_"+ "\2\2\2I\u00da\3\2\2\2K\u00dc\3\2\2\2M\u0127\3\2\2\2O\u012a\3\2\2\2Q\u0158"+
"\u0180\3\2\2\2ab\7c\2\2bc\7p\2\2cd\7f\2\2d\4\3\2\2\2ef\7c\2\2fg\7p\2\2"+ "\3\2\2\2S\u015c\3\2\2\2U\u0166\3\2\2\2W\u016f\3\2\2\2Y\u0171\3\2\2\2["+
"gh\7{\2\2h\6\3\2\2\2ij\7d\2\2jk\7{\2\2k\b\3\2\2\2lm\7h\2\2mn\7c\2\2no"+ "\u0173\3\2\2\2]\u0184\3\2\2\2_\u0194\3\2\2\2ab\7c\2\2bc\7p\2\2cd\7f\2"+
"\7n\2\2op\7u\2\2pq\7g\2\2q\n\3\2\2\2rs\7k\2\2st\7p\2\2t\f\3\2\2\2uv\7"+ "\2d\4\3\2\2\2ef\7c\2\2fg\7p\2\2gh\7{\2\2h\6\3\2\2\2ij\7d\2\2jk\7{\2\2"+
"l\2\2vw\7q\2\2wx\7k\2\2xy\7p\2\2y\16\3\2\2\2z{\7o\2\2{|\7c\2\2|}\7z\2"+ "k\b\3\2\2\2lm\7h\2\2mn\7c\2\2no\7n\2\2op\7u\2\2pq\7g\2\2q\n\3\2\2\2rs"+
"\2}~\7u\2\2~\177\7r\2\2\177\u0080\7c\2\2\u0080\u0081\7p\2\2\u0081\20\3"+ "\7k\2\2st\7p\2\2t\f\3\2\2\2uv\7l\2\2vw\7q\2\2wx\7k\2\2xy\7p\2\2y\16\3"+
"\2\2\2\u0082\u0083\7p\2\2\u0083\u0084\7q\2\2\u0084\u0085\7v\2\2\u0085"+ "\2\2\2z{\7o\2\2{|\7c\2\2|}\7z\2\2}~\7u\2\2~\177\7r\2\2\177\u0080\7c\2"+
"\22\3\2\2\2\u0086\u0087\7p\2\2\u0087\u0088\7w\2\2\u0088\u0089\7n\2\2\u0089"+ "\2\u0080\u0081\7p\2\2\u0081\20\3\2\2\2\u0082\u0083\7p\2\2\u0083\u0084"+
"\u008a\7n\2\2\u008a\24\3\2\2\2\u008b\u008c\7q\2\2\u008c\u008d\7h\2\2\u008d"+ "\7q\2\2\u0084\u0085\7v\2\2\u0085\22\3\2\2\2\u0086\u0087\7p\2\2\u0087\u0088"+
"\26\3\2\2\2\u008e\u008f\7q\2\2\u008f\u0090\7t\2\2\u0090\30\3\2\2\2\u0091"+ "\7w\2\2\u0088\u0089\7n\2\2\u0089\u008a\7n\2\2\u008a\24\3\2\2\2\u008b\u008c"+
"\u0092\7u\2\2\u0092\u0093\7g\2\2\u0093\u0094\7s\2\2\u0094\u0095\7w\2\2"+ "\7q\2\2\u008c\u008d\7h\2\2\u008d\26\3\2\2\2\u008e\u008f\7q\2\2\u008f\u0090"+
"\u0095\u0096\7g\2\2\u0096\u0097\7p\2\2\u0097\u0098\7e\2\2\u0098\u0099"+ "\7t\2\2\u0090\30\3\2\2\2\u0091\u0092\7u\2\2\u0092\u0093\7g\2\2\u0093\u0094"+
"\7g\2\2\u0099\32\3\2\2\2\u009a\u009b\7v\2\2\u009b\u009c\7t\2\2\u009c\u009d"+ "\7s\2\2\u0094\u0095\7w\2\2\u0095\u0096\7g\2\2\u0096\u0097\7p\2\2\u0097"+
"\7w\2\2\u009d\u009e\7g\2\2\u009e\34\3\2\2\2\u009f\u00a0\7w\2\2\u00a0\u00a1"+ "\u0098\7e\2\2\u0098\u0099\7g\2\2\u0099\32\3\2\2\2\u009a\u009b\7v\2\2\u009b"+
"\7p\2\2\u00a1\u00a2\7v\2\2\u00a2\u00a3\7k\2\2\u00a3\u00a4\7n\2\2\u00a4"+ "\u009c\7t\2\2\u009c\u009d\7w\2\2\u009d\u009e\7g\2\2\u009e\34\3\2\2\2\u009f"+
"\36\3\2\2\2\u00a5\u00a6\7y\2\2\u00a6\u00a7\7j\2\2\u00a7\u00a8\7g\2\2\u00a8"+ "\u00a0\7w\2\2\u00a0\u00a1\7p\2\2\u00a1\u00a2\7v\2\2\u00a2\u00a3\7k\2\2"+
"\u00a9\7t\2\2\u00a9\u00aa\7g\2\2\u00aa \3\2\2\2\u00ab\u00ac\7y\2\2\u00ac"+ "\u00a3\u00a4\7n\2\2\u00a4\36\3\2\2\2\u00a5\u00a6\7y\2\2\u00a6\u00a7\7"+
"\u00ad\7k\2\2\u00ad\u00ae\7v\2\2\u00ae\u00af\7j\2\2\u00af\"\3\2\2\2\u00b0"+ "j\2\2\u00a7\u00a8\7g\2\2\u00a8\u00a9\7t\2\2\u00a9\u00aa\7g\2\2\u00aa "+
"\u00b1\7<\2\2\u00b1$\3\2\2\2\u00b2\u00b3\7?\2\2\u00b3&\3\2\2\2\u00b4\u00b5"+ "\3\2\2\2\u00ab\u00ac\7y\2\2\u00ac\u00ad\7k\2\2\u00ad\u00ae\7v\2\2\u00ae"+
"\7?\2\2\u00b5\u00b6\7?\2\2\u00b6(\3\2\2\2\u00b7\u00b8\7#\2\2\u00b8\u00b9"+ "\u00af\7j\2\2\u00af\"\3\2\2\2\u00b0\u00b1\7<\2\2\u00b1$\3\2\2\2\u00b2"+
"\7?\2\2\u00b9*\3\2\2\2\u00ba\u00bb\7>\2\2\u00bb,\3\2\2\2\u00bc\u00bd\7"+ "\u00b3\7?\2\2\u00b3&\3\2\2\2\u00b4\u00b5\7?\2\2\u00b5\u00b6\7?\2\2\u00b6"+
">\2\2\u00bd\u00be\7?\2\2\u00be.\3\2\2\2\u00bf\u00c0\7@\2\2\u00c0\60\3"+ "(\3\2\2\2\u00b7\u00b8\7#\2\2\u00b8\u00b9\7?\2\2\u00b9*\3\2\2\2\u00ba\u00bb"+
"\2\2\2\u00c1\u00c2\7@\2\2\u00c2\u00c3\7?\2\2\u00c3\62\3\2\2\2\u00c4\u00c5"+ "\7>\2\2\u00bb,\3\2\2\2\u00bc\u00bd\7>\2\2\u00bd\u00be\7?\2\2\u00be.\3"+
"\7-\2\2\u00c5\64\3\2\2\2\u00c6\u00c7\7/\2\2\u00c7\66\3\2\2\2\u00c8\u00c9"+ "\2\2\2\u00bf\u00c0\7@\2\2\u00c0\60\3\2\2\2\u00c1\u00c2\7@\2\2\u00c2\u00c3"+
"\7,\2\2\u00c98\3\2\2\2\u00ca\u00cb\7\61\2\2\u00cb:\3\2\2\2\u00cc\u00cd"+ "\7?\2\2\u00c3\62\3\2\2\2\u00c4\u00c5\7-\2\2\u00c5\64\3\2\2\2\u00c6\u00c7"+
"\7\'\2\2\u00cd<\3\2\2\2\u00ce\u00cf\7\60\2\2\u00cf>\3\2\2\2\u00d0\u00d1"+ "\7/\2\2\u00c7\66\3\2\2\2\u00c8\u00c9\7,\2\2\u00c98\3\2\2\2\u00ca\u00cb"+
"\7.\2\2\u00d1@\3\2\2\2\u00d2\u00d3\7]\2\2\u00d3B\3\2\2\2\u00d4\u00d5\7"+ "\7\61\2\2\u00cb:\3\2\2\2\u00cc\u00cd\7\'\2\2\u00cd<\3\2\2\2\u00ce\u00cf"+
"_\2\2\u00d5D\3\2\2\2\u00d6\u00d7\7*\2\2\u00d7F\3\2\2\2\u00d8\u00d9\7+"+ "\7\60\2\2\u00cf>\3\2\2\2\u00d0\u00d1\7.\2\2\u00d1@\3\2\2\2\u00d2\u00d3"+
"\2\2\u00d9H\3\2\2\2\u00da\u00db\7~\2\2\u00dbJ\3\2\2\2\u00dc\u00e2\7b\2"+ "\7]\2\2\u00d3B\3\2\2\2\u00d4\u00d5\7_\2\2\u00d5D\3\2\2\2\u00d6\u00d7\7"+
"\2\u00dd\u00e1\n\2\2\2\u00de\u00df\7b\2\2\u00df\u00e1\7b\2\2\u00e0\u00dd"+ "*\2\2\u00d7F\3\2\2\2\u00d8\u00d9\7+\2\2\u00d9H\3\2\2\2\u00da\u00db\7~"+
"\3\2\2\2\u00e0\u00de\3\2\2\2\u00e1\u00e4\3\2\2\2\u00e2\u00e0\3\2\2\2\u00e2"+ "\2\2\u00dbJ\3\2\2\2\u00dc\u00e2\7b\2\2\u00dd\u00e1\n\2\2\2\u00de\u00df"+
"\u00e3\3\2\2\2\u00e3\u00e5\3\2\2\2\u00e4\u00e2\3\2\2\2\u00e5\u00e6\7b"+ "\7b\2\2\u00df\u00e1\7b\2\2\u00e0\u00dd\3\2\2\2\u00e0\u00de\3\2\2\2\u00e1"+
"\2\2\u00e6L\3\2\2\2\u00e7\u00ed\7)\2\2\u00e8\u00e9\7^\2\2\u00e9\u00ec"+ "\u00e4\3\2\2\2\u00e2\u00e0\3\2\2\2\u00e2\u00e3\3\2\2\2\u00e3\u00e5\3\2"+
"\t\3\2\2\u00ea\u00ec\n\4\2\2\u00eb\u00e8\3\2\2\2\u00eb\u00ea\3\2\2\2\u00ec"+ "\2\2\u00e4\u00e2\3\2\2\2\u00e5\u00e6\7b\2\2\u00e6L\3\2\2\2\u00e7\u00ed"+
"\u00ef\3\2\2\2\u00ed\u00eb\3\2\2\2\u00ed\u00ee\3\2\2\2\u00ee\u00f0\3\2"+ "\7)\2\2\u00e8\u00e9\7^\2\2\u00e9\u00ec\t\3\2\2\u00ea\u00ec\n\4\2\2\u00eb"+
"\2\2\u00ef\u00ed\3\2\2\2\u00f0\u0114\7)\2\2\u00f1\u00f7\7$\2\2\u00f2\u00f3"+ "\u00e8\3\2\2\2\u00eb\u00ea\3\2\2\2\u00ec\u00ef\3\2\2\2\u00ed\u00eb\3\2"+
"\7^\2\2\u00f3\u00f6\t\3\2\2\u00f4\u00f6\n\5\2\2\u00f5\u00f2\3\2\2\2\u00f5"+ "\2\2\u00ed\u00ee\3\2\2\2\u00ee\u00f0\3\2\2\2\u00ef\u00ed\3\2\2\2\u00f0"+
"\u00f4\3\2\2\2\u00f6\u00f9\3\2\2\2\u00f7\u00f5\3\2\2\2\u00f7\u00f8\3\2"+ "\u0128\7)\2\2\u00f1\u00f7\7$\2\2\u00f2\u00f3\7^\2\2\u00f3\u00f6\t\3\2"+
"\2\2\u00f8\u00fa\3\2\2\2\u00f9\u00f7\3\2\2\2\u00fa\u0114\7$\2\2\u00fb"+ "\2\u00f4\u00f6\n\5\2\2\u00f5\u00f2\3\2\2\2\u00f5\u00f4\3\2\2\2\u00f6\u00f9"+
"\u00fc\7A\2\2\u00fc\u00fd\7$\2\2\u00fd\u0103\3\2\2\2\u00fe\u00ff\7^\2"+ "\3\2\2\2\u00f7\u00f5\3\2\2\2\u00f7\u00f8\3\2\2\2\u00f8\u00fa\3\2\2\2\u00f9"+
"\2\u00ff\u0102\7$\2\2\u0100\u0102\n\6\2\2\u0101\u00fe\3\2\2\2\u0101\u0100"+ "\u00f7\3\2\2\2\u00fa\u0128\7$\2\2\u00fb\u00fc\7A\2\2\u00fc\u00fd\7$\2"+
"\3\2\2\2\u0102\u0105\3\2\2\2\u0103\u0101\3\2\2\2\u0103\u0104\3\2\2\2\u0104"+ "\2\u00fd\u0103\3\2\2\2\u00fe\u00ff\7^\2\2\u00ff\u0102\7$\2\2\u0100\u0102"+
"\u0106\3\2\2\2\u0105\u0103\3\2\2\2\u0106\u0114\7$\2\2\u0107\u0108\7A\2"+ "\n\6\2\2\u0101\u00fe\3\2\2\2\u0101\u0100\3\2\2\2\u0102\u0105\3\2\2\2\u0103"+
"\2\u0108\u0109\7)\2\2\u0109\u010f\3\2\2\2\u010a\u010b\7^\2\2\u010b\u010e"+ "\u0101\3\2\2\2\u0103\u0104\3\2\2\2\u0104\u0106\3\2\2\2\u0105\u0103\3\2"+
"\7)\2\2\u010c\u010e\n\7\2\2\u010d\u010a\3\2\2\2\u010d\u010c\3\2\2\2\u010e"+ "\2\2\u0106\u0128\7$\2\2\u0107\u0108\7A\2\2\u0108\u0109\7)\2\2\u0109\u010f"+
"\u0111\3\2\2\2\u010f\u010d\3\2\2\2\u010f\u0110\3\2\2\2\u0110\u0112\3\2"+ "\3\2\2\2\u010a\u010b\7^\2\2\u010b\u010e\7)\2\2\u010c\u010e\n\7\2\2\u010d"+
"\2\2\u0111\u010f\3\2\2\2\u0112\u0114\7)\2\2\u0113\u00e7\3\2\2\2\u0113"+ "\u010a\3\2\2\2\u010d\u010c\3\2\2\2\u010e\u0111\3\2\2\2\u010f\u010d\3\2"+
"\u00f1\3\2\2\2\u0113\u00fb\3\2\2\2\u0113\u0107\3\2\2\2\u0114N\3\2\2\2"+ "\2\2\u010f\u0110\3\2\2\2\u0110\u0112\3\2\2\2\u0111\u010f\3\2\2\2\u0112"+
"\u0115\u0117\5W,\2\u0116\u0115\3\2\2\2\u0117\u0118\3\2\2\2\u0118\u0116"+ "\u0128\7)\2\2\u0113\u0114\7$\2\2\u0114\u0115\7$\2\2\u0115\u0116\7$\2\2"+
"\3\2\2\2\u0118\u0119\3\2\2\2\u0119P\3\2\2\2\u011a\u011c\5W,\2\u011b\u011a"+ "\u0116\u011a\3\2\2\2\u0117\u0119\n\b\2\2\u0118\u0117\3\2\2\2\u0119\u011c"+
"\3\2\2\2\u011c\u011d\3\2\2\2\u011d\u011b\3\2\2\2\u011d\u011e\3\2\2\2\u011e"+ "\3\2\2\2\u011a\u011b\3\2\2\2\u011a\u0118\3\2\2\2\u011b\u011d\3\2\2\2\u011c"+
"\u011f\3\2\2\2\u011f\u0123\5=\37\2\u0120\u0122\5W,\2\u0121\u0120\3\2\2"+ "\u011a\3\2\2\2\u011d\u011e\7$\2\2\u011e\u011f\7$\2\2\u011f\u0120\7$\2"+
"\2\u0122\u0125\3\2\2\2\u0123\u0121\3\2\2\2\u0123\u0124\3\2\2\2\u0124\u0145"+ "\2\u0120\u0122\3\2\2\2\u0121\u0123\7$\2\2\u0122\u0121\3\2\2\2\u0122\u0123"+
"\3\2\2\2\u0125\u0123\3\2\2\2\u0126\u0128\5=\37\2\u0127\u0129\5W,\2\u0128"+ "\3\2\2\2\u0123\u0125\3\2\2\2\u0124\u0126\7$\2\2\u0125\u0124\3\2\2\2\u0125"+
"\u0127\3\2\2\2\u0129\u012a\3\2\2\2\u012a\u0128\3\2\2\2\u012a\u012b\3\2"+ "\u0126\3\2\2\2\u0126\u0128\3\2\2\2\u0127\u00e7\3\2\2\2\u0127\u00f1\3\2"+
"\2\2\u012b\u0145\3\2\2\2\u012c\u012e\5W,\2\u012d\u012c\3\2\2\2\u012e\u012f"+ "\2\2\u0127\u00fb\3\2\2\2\u0127\u0107\3\2\2\2\u0127\u0113\3\2\2\2\u0128"+
"\3\2\2\2\u012f\u012d\3\2\2\2\u012f\u0130\3\2\2\2\u0130\u0138\3\2\2\2\u0131"+ "N\3\2\2\2\u0129\u012b\5W,\2\u012a\u0129\3\2\2\2\u012b\u012c\3\2\2\2\u012c"+
"\u0135\5=\37\2\u0132\u0134\5W,\2\u0133\u0132\3\2\2\2\u0134\u0137\3\2\2"+ "\u012a\3\2\2\2\u012c\u012d\3\2\2\2\u012dP\3\2\2\2\u012e\u0130\5W,\2\u012f"+
"\2\u0135\u0133\3\2\2\2\u0135\u0136\3\2\2\2\u0136\u0139\3\2\2\2\u0137\u0135"+ "\u012e\3\2\2\2\u0130\u0131\3\2\2\2\u0131\u012f\3\2\2\2\u0131\u0132\3\2"+
"\3\2\2\2\u0138\u0131\3\2\2\2\u0138\u0139\3\2\2\2\u0139\u013a\3\2\2\2\u013a"+ "\2\2\u0132\u0133\3\2\2\2\u0133\u0137\5=\37\2\u0134\u0136\5W,\2\u0135\u0134"+
"\u013b\5U+\2\u013b\u0145\3\2\2\2\u013c\u013e\5=\37\2\u013d\u013f\5W,\2"+ "\3\2\2\2\u0136\u0139\3\2\2\2\u0137\u0135\3\2\2\2\u0137\u0138\3\2\2\2\u0138"+
"\u013e\u013d\3\2\2\2\u013f\u0140\3\2\2\2\u0140\u013e\3\2\2\2\u0140\u0141"+ "\u0159\3\2\2\2\u0139\u0137\3\2\2\2\u013a\u013c\5=\37\2\u013b\u013d\5W"+
"\3\2\2\2\u0141\u0142\3\2\2\2\u0142\u0143\5U+\2\u0143\u0145\3\2\2\2\u0144"+ ",\2\u013c\u013b\3\2\2\2\u013d\u013e\3\2\2\2\u013e\u013c\3\2\2\2\u013e"+
"\u011b\3\2\2\2\u0144\u0126\3\2\2\2\u0144\u012d\3\2\2\2\u0144\u013c\3\2"+ "\u013f\3\2\2\2\u013f\u0159\3\2\2\2\u0140\u0142\5W,\2\u0141\u0140\3\2\2"+
"\2\2\u0145R\3\2\2\2\u0146\u0149\5Y-\2\u0147\u0149\t\b\2\2\u0148\u0146"+ "\2\u0142\u0143\3\2\2\2\u0143\u0141\3\2\2\2\u0143\u0144\3\2\2\2\u0144\u014c"+
"\3\2\2\2\u0148\u0147\3\2\2\2\u0149\u014f\3\2\2\2\u014a\u014e\5Y-\2\u014b"+ "\3\2\2\2\u0145\u0149\5=\37\2\u0146\u0148\5W,\2\u0147\u0146\3\2\2\2\u0148"+
"\u014e\5W,\2\u014c\u014e\7a\2\2\u014d\u014a\3\2\2\2\u014d\u014b\3\2\2"+ "\u014b\3\2\2\2\u0149\u0147\3\2\2\2\u0149\u014a\3\2\2\2\u014a\u014d\3\2"+
"\2\u014d\u014c\3\2\2\2\u014e\u0151\3\2\2\2\u014f\u014d\3\2\2\2\u014f\u0150"+ "\2\2\u014b\u0149\3\2\2\2\u014c\u0145\3\2\2\2\u014c\u014d\3\2\2\2\u014d"+
"\3\2\2\2\u0150T\3\2\2\2\u0151\u014f\3\2\2\2\u0152\u0154\t\t\2\2\u0153"+ "\u014e\3\2\2\2\u014e\u014f\5U+\2\u014f\u0159\3\2\2\2\u0150\u0152\5=\37"+
"\u0155\t\n\2\2\u0154\u0153\3\2\2\2\u0154\u0155\3\2\2\2\u0155\u0157\3\2"+ "\2\u0151\u0153\5W,\2\u0152\u0151\3\2\2\2\u0153\u0154\3\2\2\2\u0154\u0152"+
"\2\2\u0156\u0158\5W,\2\u0157\u0156\3\2\2\2\u0158\u0159\3\2\2\2\u0159\u0157"+ "\3\2\2\2\u0154\u0155\3\2\2\2\u0155\u0156\3\2\2\2\u0156\u0157\5U+\2\u0157"+
"\3\2\2\2\u0159\u015a\3\2\2\2\u015aV\3\2\2\2\u015b\u015c\t\13\2\2\u015c"+ "\u0159\3\2\2\2\u0158\u012f\3\2\2\2\u0158\u013a\3\2\2\2\u0158\u0141\3\2"+
"X\3\2\2\2\u015d\u015e\t\f\2\2\u015eZ\3\2\2\2\u015f\u0160\7\61\2\2\u0160"+ "\2\2\u0158\u0150\3\2\2\2\u0159R\3\2\2\2\u015a\u015d\5Y-\2\u015b\u015d"+
"\u0161\7\61\2\2\u0161\u0165\3\2\2\2\u0162\u0164\n\r\2\2\u0163\u0162\3"+ "\t\t\2\2\u015c\u015a\3\2\2\2\u015c\u015b\3\2\2\2\u015d\u0163\3\2\2\2\u015e"+
"\2\2\2\u0164\u0167\3\2\2\2\u0165\u0163\3\2\2\2\u0165\u0166\3\2\2\2\u0166"+ "\u0162\5Y-\2\u015f\u0162\5W,\2\u0160\u0162\7a\2\2\u0161\u015e\3\2\2\2"+
"\u0169\3\2\2\2\u0167\u0165\3\2\2\2\u0168\u016a\7\17\2\2\u0169\u0168\3"+ "\u0161\u015f\3\2\2\2\u0161\u0160\3\2\2\2\u0162\u0165\3\2\2\2\u0163\u0161"+
"\2\2\2\u0169\u016a\3\2\2\2\u016a\u016c\3\2\2\2\u016b\u016d\7\f\2\2\u016c"+ "\3\2\2\2\u0163\u0164\3\2\2\2\u0164T\3\2\2\2\u0165\u0163\3\2\2\2\u0166"+
"\u016b\3\2\2\2\u016c\u016d\3\2\2\2\u016d\u016e\3\2\2\2\u016e\u016f\b."+ "\u0168\t\n\2\2\u0167\u0169\t\13\2\2\u0168\u0167\3\2\2\2\u0168\u0169\3"+
"\2\2\u016f\\\3\2\2\2\u0170\u0171\7\61\2\2\u0171\u0172\7,\2\2\u0172\u0177"+ "\2\2\2\u0169\u016b\3\2\2\2\u016a\u016c\5W,\2\u016b\u016a\3\2\2\2\u016c"+
"\3\2\2\2\u0173\u0176\5]/\2\u0174\u0176\13\2\2\2\u0175\u0173\3\2\2\2\u0175"+ "\u016d\3\2\2\2\u016d\u016b\3\2\2\2\u016d\u016e\3\2\2\2\u016eV\3\2\2\2"+
"\u0174\3\2\2\2\u0176\u0179\3\2\2\2\u0177\u0178\3\2\2\2\u0177\u0175\3\2"+ "\u016f\u0170\t\f\2\2\u0170X\3\2\2\2\u0171\u0172\t\r\2\2\u0172Z\3\2\2\2"+
"\2\2\u0178\u017a\3\2\2\2\u0179\u0177\3\2\2\2\u017a\u017b\7,\2\2\u017b"+ "\u0173\u0174\7\61\2\2\u0174\u0175\7\61\2\2\u0175\u0179\3\2\2\2\u0176\u0178"+
"\u017c\7\61\2\2\u017c\u017d\3\2\2\2\u017d\u017e\b/\2\2\u017e^\3\2\2\2"+ "\n\b\2\2\u0177\u0176\3\2\2\2\u0178\u017b\3\2\2\2\u0179\u0177\3\2\2\2\u0179"+
"\u017f\u0181\t\16\2\2\u0180\u017f\3\2\2\2\u0181\u0182\3\2\2\2\u0182\u0180"+ "\u017a\3\2\2\2\u017a\u017d\3\2\2\2\u017b\u0179\3\2\2\2\u017c\u017e\7\17"+
"\3\2\2\2\u0182\u0183\3\2\2\2\u0183\u0184\3\2\2\2\u0184\u0185\b\60\2\2"+ "\2\2\u017d\u017c\3\2\2\2\u017d\u017e\3\2\2\2\u017e\u0180\3\2\2\2\u017f"+
"\u0185`\3\2\2\2\"\2\u00e0\u00e2\u00eb\u00ed\u00f5\u00f7\u0101\u0103\u010d"+ "\u0181\7\f\2\2\u0180\u017f\3\2\2\2\u0180\u0181\3\2\2\2\u0181\u0182\3\2"+
"\u010f\u0113\u0118\u011d\u0123\u012a\u012f\u0135\u0138\u0140\u0144\u0148"+ "\2\2\u0182\u0183\b.\2\2\u0183\\\3\2\2\2\u0184\u0185\7\61\2\2\u0185\u0186"+
"\u014d\u014f\u0154\u0159\u0165\u0169\u016c\u0175\u0177\u0182\3\2\3\2"; "\7,\2\2\u0186\u018b\3\2\2\2\u0187\u018a\5]/\2\u0188\u018a\13\2\2\2\u0189"+
"\u0187\3\2\2\2\u0189\u0188\3\2\2\2\u018a\u018d\3\2\2\2\u018b\u018c\3\2"+
"\2\2\u018b\u0189\3\2\2\2\u018c\u018e\3\2\2\2\u018d\u018b\3\2\2\2\u018e"+
"\u018f\7,\2\2\u018f\u0190\7\61\2\2\u0190\u0191\3\2\2\2\u0191\u0192\b/"+
"\2\2\u0192^\3\2\2\2\u0193\u0195\t\16\2\2\u0194\u0193\3\2\2\2\u0195\u0196"+
"\3\2\2\2\u0196\u0194\3\2\2\2\u0196\u0197\3\2\2\2\u0197\u0198\3\2\2\2\u0198"+
"\u0199\b\60\2\2\u0199`\3\2\2\2%\2\u00e0\u00e2\u00eb\u00ed\u00f5\u00f7"+
"\u0101\u0103\u010d\u010f\u011a\u0122\u0125\u0127\u012c\u0131\u0137\u013e"+
"\u0143\u0149\u014c\u0154\u0158\u015c\u0161\u0163\u0168\u016d\u0179\u017d"+
"\u0180\u0189\u018b\u0196\3\2\3\2";
public static final ATN _ATN = public static final ATN _ATN =
new ATNDeserializer().deserialize(_serializedATN.toCharArray()); new ATNDeserializer().deserialize(_serializedATN.toCharArray());
static { static {

104
x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/parser/ExpressionTests.java
View File

@ -66,14 +66,24 @@ public class ExpressionTests extends ESTestCase {
assertEquals("hello\\\nworld", unquoteString(source("\"hello\\\\\\nworld\""))); assertEquals("hello\\\nworld", unquoteString(source("\"hello\\\\\\nworld\"")));
assertEquals("hello\\\"world", unquoteString(source("\"hello\\\\\\\"world\""))); assertEquals("hello\\\"world", unquoteString(source("\"hello\\\\\\\"world\"")));
// test for unescaped strings: ?"...." // test for unescaped strings: """...."""
assertEquals("hello\"world", unquoteString(source("?\"hello\"world\""))); assertEquals("hello\"world", unquoteString(source("\"\"\"hello\"world\"\"\"")));
assertEquals("hello\\\"world", unquoteString(source("?\"hello\\\"world\""))); assertEquals("hello\\\"world", unquoteString(source("\"\"\"hello\\\"world\"\"\"")));
assertEquals("hello'world", unquoteString(source("?\"hello'world\""))); assertEquals("\"\"hello\"\\\"world\"\"\"", unquoteString(source("\"\"\"\"\"hello\"\\\"world\"\"\"\"\"\"")));
assertEquals("hello\\nworld", unquoteString(source("?\"hello\\nworld\""))); assertEquals("hello'world", unquoteString(source("\"\"\"hello'world\"\"\"")));
assertEquals("hello\\\\nworld", unquoteString(source("?\"hello\\\\nworld\""))); assertEquals("hello'world", unquoteString(source("\"\"\"hello\'world\"\"\"")));
assertEquals("hello\\\\\\nworld", unquoteString(source("?\"hello\\\\\\nworld\""))); assertEquals("hello\\'world", unquoteString(source("\"\"\"hello\\\'world\"\"\"")));
assertEquals("hello\\\\\\\"world", unquoteString(source("?\"hello\\\\\\\"world\""))); assertEquals("hello\\nworld", unquoteString(source("\"\"\"hello\\nworld\"\"\"")));
assertEquals("hello\\\\nworld", unquoteString(source("\"\"\"hello\\\\nworld\"\"\"")));
assertEquals("hello\\\\\\nworld", unquoteString(source("\"\"\"hello\\\\\\nworld\"\"\"")));
assertEquals("hello\\\\\\\"world", unquoteString(source("\"\"\"hello\\\\\\\"world\"\"\"")));
assertEquals("\"\\\"", unquoteString(source("\"\"\"\"\\\"\"\"\"")));
assertEquals("\\\"\"\"", unquoteString(source("\"\"\"\\\"\"\"\"\"\"")));
assertEquals("\"\\\"\"", unquoteString(source("\"\"\"\"\\\"\"\"\"\"")));
assertEquals("\"\"\\\"", unquoteString(source("\"\"\"\"\"\\\"\"\"\"")));
assertEquals("\"\"", unquoteString(source("\"\"\"\"\"\"\"\"")));
assertEquals("\"\" \"\"", unquoteString(source("\"\"\"\"\" \"\"\"\"\"")));
assertEquals("", unquoteString(source("\"\"\"\"\"\"")));
} }
public void testLiterals() { public void testLiterals() {
@ -100,18 +110,80 @@ public class ExpressionTests extends ESTestCase {
public void testSingleQuotedUnescapedStringDisallowed() { public void testSingleQuotedUnescapedStringDisallowed() {
ParsingException e = expectThrows(ParsingException.class, () -> expr("?'hello world'")); ParsingException e = expectThrows(ParsingException.class, () -> expr("?'hello world'"));
assertEquals("line 1:2: Use double quotes [\"] to define string literals, not single quotes [']", assertEquals("line 1:2: Use triple double quotes [\"\"\"] to define unescaped string literals, not [?']",
e.getMessage()); e.getMessage());
e = expectThrows(ParsingException.class, () -> parser.createStatement("process where name==?'hello world'")); e = expectThrows(ParsingException.class, () -> parser.createStatement("process where name == ?'hello world'"));
assertEquals("line 1:22: Use double quotes [\"] to define string literals, not single quotes [']", assertEquals("line 1:24: Use triple double quotes [\"\"\"] to define unescaped string literals, not [?']",
e.getMessage()); e.getMessage());
} }
public void testDoubleQuotedUnescapedString() { public void testDoubleQuotedUnescapedStringForbidden() {
// "hello \" world" ParsingException e = expectThrows(ParsingException.class, () -> expr("?\"hello world\""));
Expression parsed = expr("?\"hello \\\" world!\""); assertEquals("line 1:2: Use triple double quotes [\"\"\"] to define unescaped string literals, not [?\"]",
Expression expected = new Literal(null, "hello \\\" world!", DataTypes.KEYWORD); e.getMessage());
assertEquals(expected, parsed); e = expectThrows(ParsingException.class, () -> parser.createStatement("process where name == ?\"hello world\""));
assertEquals("line 1:24: Use triple double quotes [\"\"\"] to define unescaped string literals, not [?\"]",
e.getMessage());
}
public void testTripleDoubleQuotedUnescapedString() {
// """hello world!"""" == """foobar""" => hello world! = foobar
String str = "\"\"\"hello world!\"\"\" == \"\"\"foobar\"\"\"";
String expectedStrLeft = "hello world!";
String expectedStrRight = "foobar";
Expression parsed = expr(str);
assertEquals(Equals.class, parsed.getClass());
Equals eq = (Equals) parsed;
assertEquals(Literal.class, eq.left().getClass());
assertEquals(expectedStrLeft, ((Literal) eq.left()).value());
assertEquals(Literal.class, eq.right().getClass());
assertEquals(expectedStrRight, ((Literal) eq.right()).value());
// """""hello""world!"""" == """"foo"bar""""" => ""hello""world!" = "foo""bar""
str = " \"\"\"\"\"hello\"\"world!\"\"\"\" == \"\"\"\"foo\"bar\"\"\"\"\" ";
expectedStrLeft = "\"\"hello\"\"world!\"";
expectedStrRight = "\"foo\"bar\"\"";
parsed = expr(str);
assertEquals(Equals.class, parsed.getClass());
eq = (Equals) parsed;
assertEquals(Literal.class, eq.left().getClass());
assertEquals(expectedStrLeft, ((Literal) eq.left()).value());
assertEquals(Literal.class, eq.right().getClass());
assertEquals(expectedStrRight, ((Literal) eq.right()).value());
// """""\""hello\\""\""world!\\""""" == """\\""\""foo""\\""\"bar""\\""\"""" =>
// ""\""hello\\""\""world!\\"" == \\""\""foo""\\""\"bar""\\""\"
str = " \"\"\"\"\"\\\"\"hello\\\\\"\"\\\"\"world!\\\\\"\"\"\"\" == " +
" \"\"\"\\\\\"\"\\\"\"foo\"\"\\\\\"\"\\\"bar\"\"\\\\\"\"\\\"\"\"\" ";
expectedStrLeft = "\"\"\\\"\"hello\\\\\"\"\\\"\"world!\\\\\"\"";
expectedStrRight = "\\\\\"\"\\\"\"foo\"\"\\\\\"\"\\\"bar\"\"\\\\\"\"\\\"";
parsed = expr(str);
assertEquals(Equals.class, parsed.getClass());
eq = (Equals) parsed;
assertEquals(Literal.class, eq.left().getClass());
assertEquals(expectedStrLeft, ((Literal) eq.left()).value());
assertEquals(Literal.class, eq.right().getClass());
assertEquals(expectedStrRight, ((Literal) eq.right()).value());
// """"""hello world!""" == """foobar"""
ParsingException e = expectThrows(ParsingException.class, "Expected syntax error",
() -> expr("\"\"\"\"\"\"hello world!\"\"\" == \"\"\"foobar\"\"\""));
assertThat(e.getMessage(), startsWith("line 1:7: mismatched input 'hello' expecting {<EOF>,"));
// """""\"hello world!"""""" == """foobar"""
e = expectThrows(ParsingException.class, "Expected syntax error",
() -> expr("\"\"\"\"\"\\\"hello world!\"\"\"\"\"\" == \"\"\"foobar\"\"\""));
assertThat(e.getMessage(), startsWith("line 1:25: mismatched input '\" == \"' expecting {<EOF>,"));
// """""\"hello world!""\"""" == """"""foobar"""
e = expectThrows(ParsingException.class, "Expected syntax error",
() -> expr("\"\"\"\"\"\\\"hello world!\"\"\\\"\"\"\" == \"\"\"\"\"\"foobar\"\"\""));
assertThat(e.getMessage(), startsWith("line 1:37: mismatched input 'foobar' expecting {<EOF>,"));
// """""\"hello world!""\"""" == """""\"foobar\"\""""""
e = expectThrows(ParsingException.class, "Expected syntax error",
() -> expr("\"\"\"\"\"\\\"hello world!\"\"\\\"\"\"\" == \"\"\"\"\"\\\"foobar\\\"\\\"\"\"\"\"\""));
assertEquals("line 1:52: token recognition error at: '\"'", e.getMessage());
} }
public void testNumbers() { public void testNumbers() {

10
x-pack/plugin/eql/src/test/resources/queries-supported.eql
View File

@ -178,19 +178,19 @@ process where command_line : "*%*%*" ;
process where command_line : "%*%*" ; process where command_line : "%*%*" ;
process where match(?".*?net1\s+localgroup\s+.*?", command_line) process where match(""".*?net1\s+localgroup\s+.*?""", command_line)
; ;
process where match(?".*?net1\s+\w+\s+.*?", command_line) process where match(""".*?net1\s+\w+\s+.*?""", command_line)
; ;
process where match(?".*?net1\s+\w{4,15}\s+.*?", command_line) process where match(""".*?net1\s+\w{4,15}\s+.*?""", command_line)
; ;
process where match(?".*?net1\s+\w{4,15}\s+.*?", command_line) process where match(""".*?net1\s+\w{4,15}\s+.*?""", command_line)
; ;
process where match(?".*?net1\s+[localgrup]{4,15}\s+.*?", command_line) process where match(""".*?net1\s+[localgrup]{4,15}\s+.*?""", command_line)
; ;
file where opcode:0 and startsWith(file_name, "exploRER.") file where opcode:0 and startsWith(file_name, "exploRER.")