Merge pull request #38 from UncoderIO/logscale_qradar_escape_fix

Logscale and qradar escaping fixes

Author: nazargesyk

translator/app/translator/platforms/logscale/escape_manager.py

@@ -5,7 +5,7 @@
 
 class LogscaleEscapeManager(EscapeManager):
     escape_map = {
-        ValueType.value: EscapeDetails(pattern='(\+|\\\\|{|\[|\*|"|\(|\)|/(?![*?\\\\]))')
+        ValueType.value: EscapeDetails(pattern='(/|\+|\\\\|{|\[|\*|"|\(|\)(?![*?\\\\]))')
     }
 
 

translator/app/translator/platforms/logscale/renders/logscale.py

@@ -63,7 +63,7 @@ def not_equal_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
     def contains_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
         if isinstance(value, list):
             return f"({self.or_token.join(self.contains_modifier(field=field, value=v) for v in value)})"
-        return f'{self.apply_field_name(field_name=field)}=/{self.apply_value(value)}/i'
+        return f'{self.apply_field_name(field_name=field)}=/{self.apply_value(value) if value else "^"}/i'
 
     def endswith_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
         if isinstance(value, list):

translator/app/translator/platforms/qradar/escape_manager.py

@@ -1,12 +1,8 @@
-from app.translator.core.custom_types.values import ValueType
 from app.translator.core.escape_manager import EscapeManager
-from app.translator.core.models.escape_details import EscapeDetails
 
 
 class QradarEscapeManager(EscapeManager):
-    escape_map = {
-        ValueType.value: EscapeDetails(pattern="([\\\])")
-    }
+    escape_map = {}
 
 
 qradar_escape_manager = QradarEscapeManager()

translator/app/translator/platforms/qradar/renders/qradar.py

@@ -35,10 +35,10 @@ class QradarFieldValue(BaseQueryFieldValue):
 
     def apply_value(self, value: Union[str, int], value_type: str = ValueType.value) -> Union[str, int]:
         if isinstance(value, str):
-            value = value.replace("\\'", "%").replace("'", '"')
+            value = value.replace("_", "__").replace("%", "%%").replace("\\'", "%").replace("'", '"')
             if value.endswith("\\\\%"):
                 value = value.replace("\\\\%", "\\%")
-        return super().apply_value(value, value_type)
+        return value
 
     def _apply_value(self, value: Union[str, int]) -> Union[str, int]:
         if isinstance(value, str) and "\\" in value: