Add base64Decode template functions (#28385)

CHANGELOG.next.asciidoc

@@ -759,6 +759,7 @@ for a few releases. Please use other tools provided by Elastic to fetch data fro
 - Move processing to ingest node for AWS vpcflow fileset. {pull}28168[28168]
 - Release zoom module as GA. {pull}28106[28106]
 - Add support for secondary object attribute handling in ThreatIntel MISP module {pull}28124[28124]
+- Add `base64Decode` and `base64DecodeNoPad` functions to `httpsjon` templates. {pull}28385[28385]
 
 *Heartbeat*
 

x-pack/filebeat/docs/inputs/input-httpjson.asciidoc

@@ -201,6 +201,8 @@ Some built-in helper functions are provided to work with the input state inside
 - `hmac`: calculates the hmac signature of a list of strings concatenated together. Returns a hex encoded signature. Supports sha1 or sha256. Example `[[hmac "sha256" "secret" "string1" "string2" (formatDate (now) "RFC1123")]]`
 - `base64Encode`: Joins and base64 encodes all supplied strings. Example `[[base64Encode "string1" "string2"]]`
 - `base64EncodeNoPad`: Joins and base64 encodes all supplied strings without padding. Example `[[base64EncodeNoPad "string1" "string2"]]`
+- `base64Decode`: Decodes the base64 string. Any binary output will be converted to a UTF8 string.
+- `base64DecodeNoPad`: Decodes the base64 string without padding. Any binary output will be converted to a UTF8 string.
 - `join`: joins a list using the specified separator. Example: `[[join .body.arr ","]]`
 - `sprintf`: formats according to a format specifier and returns the resulting string. Refer to https://pkg.go.dev/fmt#Sprintf[the Go docs] for usage. Example: `[[sprintf "%d:%q" 34 "quote this"]]`
 - `hmacBase64`: calculates the hmac signature of a list of strings concatenated together. Returns a base64 encoded signature. Supports sha1 or sha256. Example `[[hmac "sha256" "secret" "string1" "string2" (formatDate (now) "RFC1123")]]`

x-pack/filebeat/input/httpjson/value_tpl.go

@@ -60,6 +60,8 @@ func (t *valueTpl) Unpack(in string) error {
  "hmac": hmacStringHex,
  "base64Encode": base64Encode,
  "base64EncodeNoPad": base64EncodeNoPad,
+ "base64Decode": base64Decode,
+ "base64DecodeNoPad": base64DecodeNoPad,
  "join": join,
  "sprintf": fmt.Sprintf,
  "hmacBase64": hmacStringBase64,
@@ -271,17 +273,27 @@ func base64EncodeNoPad(values ...string) string {
  return base64.RawStdEncoding.EncodeToString([]byte(data))
 }
 
-func hmacString(hmacType string, hmacKey string, data string) []byte {
+func base64Decode(enc string) string {
+ dec, _ := base64.StdEncoding.DecodeString(enc)
+ return string(dec)
+}
+
+func base64DecodeNoPad(enc string) string {
+ dec, _ := base64.RawStdEncoding.DecodeString(enc)
+ return string(dec)
+}
+
+func hmacString(hmacType string, hmacKey []byte, data string) []byte {
  if data == "" {
  return nil
  }
  // Create a new HMAC by defining the hash type and the key (as byte array)
  var mac hash.Hash
  switch hmacType {
  case "sha256":
- mac = hmac.New(sha256.New, []byte(hmacKey))
+ mac = hmac.New(sha256.New, hmacKey)
  case "sha1":
- mac = hmac.New(sha1.New, []byte(hmacKey))
+ mac = hmac.New(sha1.New, hmacKey)
  default:
  // Upstream config validation prevents this from happening.
  return nil
@@ -298,7 +310,7 @@ func hmacStringHex(hmacType string, hmacKey string, values ...string) string {
  if data == "" {
  return ""
  }
- bytes := hmacString(hmacType, hmacKey, data)
+ bytes := hmacString(hmacType, []byte(hmacKey), data)
  // Get result and encode as hexadecimal string
  return hex.EncodeToString(bytes)
 }
@@ -308,7 +320,7 @@ func hmacStringBase64(hmacType string, hmacKey string, values ...string) string
  if data == "" {
  return ""
  }
- bytes := hmacString(hmacType, hmacKey, data)
+ bytes := hmacString(hmacType, []byte(hmacKey), data)
 
  // Get result and encode as hexadecimal string
  return base64.StdEncoding.EncodeToString(bytes)

x-pack/filebeat/input/httpjson/value_tpl_test.go

@@ -367,6 +367,21 @@ func TestValueTpl(t *testing.T) {
  expectedVal: "",
  expectedError: errEmptyTemplateResult.Error(),
  },
+ {
+ name: "func base64Decode 2 strings",
+ value: `[[base64Decode "c3RyaW5nMXN0cmluZzI="]]`,
+ paramCtx: emptyTransformContext(),
+ paramTr: transformable{},
+ expectedVal: "string1string2",
+ },
+ {
+ name: "func base64Decode no value",
+ value: `[[base64Decode ""]]`,
+ paramCtx: emptyTransformContext(),
+ paramTr: transformable{},
+ expectedVal: "",
+ expectedError: errEmptyTemplateResult.Error(),
+ },
  }
 
  for _, tc := range cases {