github.com/crowdsecurity/crowdsec@v1.6.1/pkg/exprhelpers/expr_lib.go (about)

     1  package exprhelpers
     2  
     3  import (
     4  	"time"
     5  
     6  	"github.com/crowdsecurity/crowdsec/pkg/cticlient"
     7  )
     8  
     9  type exprCustomFunc struct {
    10  	name      string
    11  	function  func(params ...any) (any, error)
    12  	signature []interface{}
    13  }
    14  
    15  var exprFuncs = []exprCustomFunc{
    16  	{
    17  		name:     "CrowdsecCTI",
    18  		function: CrowdsecCTI,
    19  		signature: []interface{}{
    20  			new(func(string) (*cticlient.SmokeItem, error)),
    21  		},
    22  	},
    23  	{
    24  		name:      "Flatten",
    25  		function:  Flatten,
    26  		signature: []interface{}{},
    27  	},
    28  	{
    29  		name:      "Distinct",
    30  		function:  Distinct,
    31  		signature: []interface{}{},
    32  	},
    33  	{
    34  		name:      "FlattenDistinct",
    35  		function:  FlattenDistinct,
    36  		signature: []interface{}{},
    37  	},
    38  	{
    39  		name:     "Distance",
    40  		function: Distance,
    41  		signature: []interface{}{
    42  			new(func(string, string, string, string) (float64, error)),
    43  		},
    44  	},
    45  	{
    46  		name:     "GetFromStash",
    47  		function: GetFromStash,
    48  		signature: []interface{}{
    49  			new(func(string, string) (string, error)),
    50  		},
    51  	},
    52  	{
    53  		name:     "Atof",
    54  		function: Atof,
    55  		signature: []interface{}{
    56  			new(func(string) float64),
    57  		},
    58  	},
    59  	{
    60  		name:     "JsonExtract",
    61  		function: JsonExtract,
    62  		signature: []interface{}{
    63  			new(func(string, string) string),
    64  		},
    65  	},
    66  	{
    67  		name:     "JsonExtractUnescape",
    68  		function: JsonExtractUnescape,
    69  		signature: []interface{}{
    70  			new(func(string, ...string) string),
    71  		},
    72  	},
    73  	{
    74  		name:     "JsonExtractLib",
    75  		function: JsonExtractLib,
    76  		signature: []interface{}{
    77  			new(func(string, ...string) string),
    78  		},
    79  	},
    80  	{
    81  		name:     "JsonExtractSlice",
    82  		function: JsonExtractSlice,
    83  		signature: []interface{}{
    84  			new(func(string, string) []interface{}),
    85  		},
    86  	},
    87  	{
    88  		name:     "JsonExtractObject",
    89  		function: JsonExtractObject,
    90  		signature: []interface{}{
    91  			new(func(string, string) map[string]interface{}),
    92  		},
    93  	},
    94  	{
    95  		name:     "ToJsonString",
    96  		function: ToJson,
    97  		signature: []interface{}{
    98  			new(func(interface{}) string),
    99  		},
   100  	},
   101  	{
   102  		name:     "File",
   103  		function: File,
   104  		signature: []interface{}{
   105  			new(func(string) []string),
   106  		},
   107  	},
   108  	{
   109  		name:     "RegexpInFile",
   110  		function: RegexpInFile,
   111  		signature: []interface{}{
   112  			new(func(string, string) bool),
   113  		},
   114  	},
   115  	{
   116  		name:     "Upper",
   117  		function: Upper,
   118  		signature: []interface{}{
   119  			new(func(string) string),
   120  		},
   121  	},
   122  	{
   123  		name:     "Lower",
   124  		function: Lower,
   125  		signature: []interface{}{
   126  			new(func(string) string),
   127  		},
   128  	},
   129  	{
   130  		name:     "IpInRange",
   131  		function: IpInRange,
   132  		signature: []interface{}{
   133  			new(func(string, string) bool),
   134  		},
   135  	},
   136  	{
   137  		name:     "TimeNow",
   138  		function: TimeNow,
   139  		signature: []interface{}{
   140  			new(func() string),
   141  		},
   142  	},
   143  	{
   144  		name:     "ParseUri",
   145  		function: ParseUri,
   146  		signature: []interface{}{
   147  			new(func(string) map[string][]string),
   148  		},
   149  	},
   150  	{
   151  		name:     "PathUnescape",
   152  		function: PathUnescape,
   153  		signature: []interface{}{
   154  			new(func(string) string),
   155  		},
   156  	},
   157  	{
   158  		name:     "QueryUnescape",
   159  		function: QueryUnescape,
   160  		signature: []interface{}{
   161  			new(func(string) string),
   162  		},
   163  	},
   164  	{
   165  		name:     "PathEscape",
   166  		function: PathEscape,
   167  		signature: []interface{}{
   168  			new(func(string) string),
   169  		},
   170  	},
   171  	{
   172  		name:     "QueryEscape",
   173  		function: QueryEscape,
   174  		signature: []interface{}{
   175  			new(func(string) string),
   176  		},
   177  	},
   178  	{
   179  		name:     "XMLGetAttributeValue",
   180  		function: XMLGetAttributeValue,
   181  		signature: []interface{}{
   182  			new(func(string, string, string) string),
   183  		},
   184  	},
   185  	{
   186  		name:     "XMLGetNodeValue",
   187  		function: XMLGetNodeValue,
   188  		signature: []interface{}{
   189  			new(func(string, string) string),
   190  		},
   191  	},
   192  	{
   193  		name:     "IpToRange",
   194  		function: IpToRange,
   195  		signature: []interface{}{
   196  			new(func(string, string) string),
   197  		},
   198  	},
   199  	{
   200  		name:     "IsIPV6",
   201  		function: IsIPV6,
   202  		signature: []interface{}{
   203  			new(func(string) bool),
   204  		},
   205  	},
   206  	{
   207  		name:     "IsIPV4",
   208  		function: IsIPV4,
   209  		signature: []interface{}{
   210  			new(func(string) bool),
   211  		},
   212  	},
   213  	{
   214  		name:     "IsIP",
   215  		function: IsIP,
   216  		signature: []interface{}{
   217  			new(func(string) bool),
   218  		},
   219  	},
   220  	{
   221  		name:     "LookupHost",
   222  		function: LookupHost,
   223  		signature: []interface{}{
   224  			new(func(string) []string),
   225  		},
   226  	},
   227  	{
   228  		name:     "GetDecisionsCount",
   229  		function: GetDecisionsCount,
   230  		signature: []interface{}{
   231  			new(func(string) int),
   232  		},
   233  	},
   234  	{
   235  		name:     "GetDecisionsSinceCount",
   236  		function: GetDecisionsSinceCount,
   237  		signature: []interface{}{
   238  			new(func(string, string) int),
   239  		},
   240  	},
   241  	{
   242  		name:     "Sprintf",
   243  		function: Sprintf,
   244  		signature: []interface{}{
   245  			new(func(string, ...interface{}) string),
   246  		},
   247  	},
   248  	{
   249  		name:     "ParseUnix",
   250  		function: ParseUnix,
   251  		signature: []interface{}{
   252  			new(func(string) string),
   253  		},
   254  	},
   255  	{
   256  		name:     "SetInStash", //FIXME: signature will probably blow everything up
   257  		function: SetInStash,
   258  		signature: []interface{}{
   259  			new(func(string, string, string, *time.Duration) error),
   260  		},
   261  	},
   262  	{
   263  		name:     "Fields",
   264  		function: Fields,
   265  		signature: []interface{}{
   266  			new(func(string) []string),
   267  		},
   268  	},
   269  	{
   270  		name:     "Index",
   271  		function: Index,
   272  		signature: []interface{}{
   273  			new(func(string, string) int),
   274  		},
   275  	},
   276  	{
   277  		name:     "IndexAny",
   278  		function: IndexAny,
   279  		signature: []interface{}{
   280  			new(func(string, string) int),
   281  		},
   282  	},
   283  	{
   284  		name:     "Join",
   285  		function: Join,
   286  		signature: []interface{}{
   287  			new(func([]string, string) string),
   288  		},
   289  	},
   290  	{
   291  		name:     "Split",
   292  		function: Split,
   293  		signature: []interface{}{
   294  			new(func(string, string) []string),
   295  		},
   296  	},
   297  	{
   298  		name:     "SplitAfter",
   299  		function: SplitAfter,
   300  		signature: []interface{}{
   301  			new(func(string, string) []string),
   302  		},
   303  	},
   304  	{
   305  		name:     "SplitAfterN",
   306  		function: SplitAfterN,
   307  		signature: []interface{}{
   308  			new(func(string, string, int) []string),
   309  		},
   310  	},
   311  	{
   312  		name:     "SplitN",
   313  		function: SplitN,
   314  		signature: []interface{}{
   315  			new(func(string, string, int) []string),
   316  		},
   317  	},
   318  	{
   319  		name:     "Replace",
   320  		function: Replace,
   321  		signature: []interface{}{
   322  			new(func(string, string, string, int) string),
   323  		},
   324  	},
   325  	{
   326  		name:     "ReplaceAll",
   327  		function: ReplaceAll,
   328  		signature: []interface{}{
   329  			new(func(string, string, string) string),
   330  		},
   331  	},
   332  	{
   333  		name:     "Trim",
   334  		function: Trim,
   335  		signature: []interface{}{
   336  			new(func(string, string) string),
   337  		},
   338  	},
   339  	{
   340  		name:     "TrimLeft",
   341  		function: TrimLeft,
   342  		signature: []interface{}{
   343  			new(func(string, string) string),
   344  		},
   345  	},
   346  	{
   347  		name:     "TrimRight",
   348  		function: TrimRight,
   349  		signature: []interface{}{
   350  			new(func(string, string) string),
   351  		},
   352  	},
   353  	{
   354  		name:     "TrimSpace",
   355  		function: TrimSpace,
   356  		signature: []interface{}{
   357  			new(func(string) string),
   358  		},
   359  	},
   360  	{
   361  		name:     "TrimPrefix",
   362  		function: TrimPrefix,
   363  		signature: []interface{}{
   364  			new(func(string, string) string),
   365  		},
   366  	},
   367  	{
   368  		name:     "TrimSuffix",
   369  		function: TrimSuffix,
   370  		signature: []interface{}{
   371  			new(func(string, string) string),
   372  		},
   373  	},
   374  	{
   375  		name:     "Get",
   376  		function: Get,
   377  		signature: []interface{}{
   378  			new(func([]string, int) string),
   379  		},
   380  	},
   381  	{
   382  		name:     "ToString",
   383  		function: ToString,
   384  		signature: []interface{}{
   385  			new(func(interface{}) string),
   386  		},
   387  	},
   388  	{
   389  		name:     "Match",
   390  		function: Match,
   391  		signature: []interface{}{
   392  			new(func(string, string) bool),
   393  		},
   394  	},
   395  	{
   396  		name:     "KeyExists",
   397  		function: KeyExists,
   398  		signature: []interface{}{
   399  			new(func(string, map[string]any) bool),
   400  		},
   401  	},
   402  	{
   403  		name:     "LogInfo",
   404  		function: LogInfo,
   405  		signature: []interface{}{
   406  			new(func(string, ...interface{}) bool),
   407  		},
   408  	},
   409  	{
   410  		name:     "B64Decode",
   411  		function: B64Decode,
   412  		signature: []interface{}{
   413  			new(func(string) string),
   414  		},
   415  	},
   416  	{
   417  		name:     "UnmarshalJSON",
   418  		function: UnmarshalJSON,
   419  		signature: []interface{}{
   420  			new(func(string, map[string]interface{}, string) error),
   421  		},
   422  	},
   423  	{
   424  		name:     "ParseKV",
   425  		function: ParseKV,
   426  		signature: []interface{}{
   427  			new(func(string, map[string]interface{}, string) error),
   428  		},
   429  	},
   430  	{
   431  		name:     "Hostname",
   432  		function: Hostname,
   433  		signature: []interface{}{
   434  			new(func() (string, error)),
   435  		},
   436  	},
   437  	{
   438  		name:     "FloatApproxEqual",
   439  		function: FloatApproxEqual,
   440  		signature: []interface{}{
   441  			new(func(float64, float64) bool),
   442  		},
   443  	},
   444  	{
   445  		name:     "LibInjectionIsSQLI",
   446  		function: LibInjectionIsSQLI,
   447  		signature: []interface{}{
   448  			new(func(string) bool),
   449  		},
   450  	},
   451  	{
   452  		name:     "LibInjectionIsXSS",
   453  		function: LibInjectionIsXSS,
   454  		signature: []interface{}{
   455  			new(func(string) bool),
   456  		},
   457  	},
   458  }
   459  
   460  //go 1.20 "CutPrefix":              strings.CutPrefix,
   461  //go 1.20 "CutSuffix": strings.CutSuffix,
   462  //"Cut":         strings.Cut, -> returns more than 2 values, not supported  by expr