Skip to content

Filebeat input httpjson getRFC5988Link doesn't work with single string with multiple relation-types #32810

@kcreddy

Description

@kcreddy

RFC5988 Link response header is getting parsed as a single string with multiple relation-types. This causes unexpected behaviour when rel="next" doesn't occur as first element in the Link header.

Example (Github Code Scanning integration):

Header (from curl -v):
link: <https://api.github.com/organizations/108426244/code-scanning/alerts?before=eyJhbGVydF9pZCI6Mzc4OTI3MTEsImNyZWF0ZWRfYXQiOjE2NjAzMDU2OTQ5NjF9Cg%3D%3D>; rel="prev", <https://api.github.com/organizations/108426244/code-scanning/alerts?after=eyJhbGVydF9pZCI6Mzc4OTI2ODIsImNyZWF0ZWRfYXQiOjE2NjAzMDU2OTQ5NjF9Cg%3D%3D>; rel="next"
gets parsed as following (as per debug logs):
\"Link\":[]string{\"<https://api.github.com/organizations/108426244/code-scanning/alerts?before=eyJhbGVydF9pZCI6Mzc4OTI3MTEsImNyZWF0ZWRfYXQiOjE2NjAzMDU2OTQ5NjF9Cg%3D%3D>; rel=\\\"prev\\\", <https://api.github.com/organizations/108426244/code-scanning/alerts?after=eyJhbGVydF9pZCI6Mzc4OTI2ODIsImNyZWF0ZWRfYXQiOjE2NjAzMDU2OTQ5NjF9Cg%3D%3D>; rel=\\\"next\\\"\"}

i.e., the response header contain string slice with just 1 element with multiple relation-types rather than multiple elements each with single relation-type. When this is passed into getRFC5988Link using template [[ getRFC5988Link "next" .last_response.header.Link ]], the return value is https://api.github.com/organizations/108426244/code-scanning/alerts?before=eyJhbGVydF9pZCI6Mzc4OTI3MTEsImNyZWF0ZWRfYXQiOjE2NjAzMDU2OTQ5NjF9Cg%3D%3D>; rel=\\\"prev\\\", <https://api.github.com/organizations/108426244/code-scanning/alerts?after=eyJhbGVydF9pZCI6Mzc4OTI2ODIsImNyZWF0ZWRfYXQiOjE2NjAzMDU2OTQ5NjF9Cg%3D%3D which is entire string until the “next” characters and this behaviour leads to 400 Bad Request.

Metadata

Metadata

Assignees

Labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions