From ea6b32884efdfd23f75d5acce89855e255b2dcc0 Mon Sep 17 00:00:00 2001 From: Adrian Serrano Date: Thu, 21 Mar 2019 15:02:03 +0100 Subject: [PATCH] Fix Winlogbeat escaping CRLF and TAB characters (#11357) Previous fix (#11006) made Winlogbeat escape CRLF control characters which are expected in Windows event logs. Fixes #11328 (cherry picked from commit 6865403b24322a0ac3bdd5c05e75380e8ac16f57) --- CHANGELOG.next.asciidoc | 1 + winlogbeat/sys/event_test.go | 21 ++++++----------- winlogbeat/sys/xmlreader.go | 2 +- winlogbeat/tests/system/test_eventlogging.py | 24 ++++++++++++++++++++ winlogbeat/tests/system/test_wineventlog.py | 24 ++++++++++++++++++++ 5 files changed, 57 insertions(+), 15 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 7510d7861f8..e68d087d77e 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -159,6 +159,7 @@ https://github.com/elastic/beats/compare/v6.6.0...6.x[Check the HEAD diff] *Winlogbeat* - Prevent Winlogbeat from dropping events with invalid XML. {pull}11006{11006} +- Fix Winlogbeat escaping CR, LF and TAB characters. {issue}11328[11328] {pull}11357[11357] *Functionbeat* diff --git a/winlogbeat/sys/event_test.go b/winlogbeat/sys/event_test.go index c77c05c2ea3..c9c1af3a756 100644 --- a/winlogbeat/sys/event_test.go +++ b/winlogbeat/sys/event_test.go @@ -21,6 +21,7 @@ import ( "encoding/json" "encoding/xml" "fmt" + "strings" "testing" "time" @@ -168,21 +169,13 @@ func TestXML(t *testing.T) { } } +// Tests that control characters other than CR and LF are escaped +// when the event is decoded. func TestInvalidXML(t *testing.T) { - eventXML := fmt.Sprintf(` - - - - {00000000-0000-0000-0000-000000000000} - じゃあ宇宙カウボーイ。。。%s - - - -`, "\x1b") - _, err := UnmarshalEventXML([]byte(eventXML)) - if !assert.NoError(t, err) { - assert.Equal(t, err.Error(), "XML syntax error on line 6: illegal character code U+001B") - } + evXML := strings.Replace(allXML, "%1", "\t \n\x1b", -1) + ev, err := UnmarshalEventXML([]byte(evXML)) + assert.Equal(t, nil, err) + assert.Equal(t, "Creating WSMan shell on server with ResourceUri: \t\r\n\\u001b", ev.Message) } func BenchmarkXMLUnmarshal(b *testing.B) { diff --git a/winlogbeat/sys/xmlreader.go b/winlogbeat/sys/xmlreader.go index 8eb23e1ce14..ba51c90dcd5 100644 --- a/winlogbeat/sys/xmlreader.go +++ b/winlogbeat/sys/xmlreader.go @@ -58,7 +58,7 @@ func (r *xmlSafeReader) Read(d []byte) (n int, err error) { } for i := 0; i < len(r.buf); { code, size := utf8.DecodeRune(r.buf[i:]) - if unicode.IsControl(code) { + if !unicode.IsSpace(code) && unicode.IsControl(code) { n = copy(d, r.buf[:i]) r.buf = r.buf[n+1:] r.code = []byte(fmt.Sprintf("\\u%04x", code)) diff --git a/winlogbeat/tests/system/test_eventlogging.py b/winlogbeat/tests/system/test_eventlogging.py index adfbef28078..37c01d1e769 100644 --- a/winlogbeat/tests/system/test_eventlogging.py +++ b/winlogbeat/tests/system/test_eventlogging.py @@ -232,3 +232,27 @@ def test_processors(self): evts = self.read_events(config) self.assertTrue(len(evts), 1) self.assertNotIn("message", evts[0]) + + def test_multiline_events(self): + """ + eventlogging - Event with newlines and control characters + """ + msg = """ +A trusted logon process has been registered with the Local Security Authority. +This logon process will be trusted to submit logon requests. + +Subject: + +Security ID: SYSTEM +Account Name: MS4\x1e$ +Account Domain: WORKGROUP +Logon ID: 0x3e7 +Logon Process Name: IKE""" + self.write_event_log(msg) + evts = self.read_events() + self.assertTrue(len(evts), 1) + self.assertEqual(unicode(self.api), evts[0]["winlog.api"], evts[0]) + self.assertNotIn("event.original", evts[0], msg=evts[0]) + self.assertIn("message", evts[0], msg=evts[0]) + self.assertNotIn("\\u000a", evts[0]["message"], msg=evts[0]) + self.assertEqual(unicode(msg), evts[0]["message"].decode('unicode-escape'), msg=evts[0]) diff --git a/winlogbeat/tests/system/test_wineventlog.py b/winlogbeat/tests/system/test_wineventlog.py index 757bdbc7e18..fe5d2939bfc 100644 --- a/winlogbeat/tests/system/test_wineventlog.py +++ b/winlogbeat/tests/system/test_wineventlog.py @@ -376,3 +376,27 @@ def test_processors(self): evts = self.read_events(config) self.assertTrue(len(evts), 1) self.assertNotIn("message", evts[0]) + + def test_multiline_events(self): + """ + wineventlog - Event with newlines and control characters + """ + msg = """ +A trusted logon process has been registered with the Local Security Authority. +This logon process will be trusted to submit logon requests. + +Subject: + +Security ID: SYSTEM +Account Name: MS4\x1e$ +Account Domain: WORKGROUP +Logon ID: 0x3e7 +Logon Process Name: IKE""" + self.write_event_log(msg) + evts = self.read_events() + self.assertTrue(len(evts), 1) + self.assertEqual(unicode(self.api), evts[0]["winlog.api"], msg=evts[0]) + self.assertNotIn("event.original", evts[0], msg=evts[0]) + self.assertIn("message", evts[0], msg=evts[0]) + self.assertNotIn("\\u000a", evts[0]["message"], msg=evts[0]) + self.assertEqual(unicode(msg), evts[0]["message"].decode('unicode-escape'), msg=evts[0])