While testing edge cases for log parsers I noticed that application names can contain quotes.
These quotes are not being escaped in the STRUCTURED_DATA section. An app with the name name with " quote ends up being name with " quote instead of name with \" quote
<14>1 2021-12-24T22:38:01.32+00:00 [REDACTED].name-with--quote (...) [API/10] - [tags@47450 (...) app_name="name with " quote" (...)
TBD whether this is the case for other fields/characters (\, ]) as well.
RFC https://datatracker.ietf.org/doc/html/rfc5424#section-6.3.3
Inside PARAM-VALUE, the characters '"' (ABNF %d34), '' (ABNF %d92), and ']' (ABNF %d93) MUST be escaped.
While testing edge cases for log parsers I noticed that application names can contain quotes.
These quotes are not being escaped in the STRUCTURED_DATA section. An app with the name
name with " quoteends up beingname with " quoteinstead ofname with \" quoteTBD whether this is the case for other fields/characters (
\, ]) as well.RFC https://datatracker.ietf.org/doc/html/rfc5424#section-6.3.3