fix: escape double quote (#741)

* fix: escape double quote

* test: addtional tests

Author: kkania-splunk

pytest_splunk_addon/standard_lib/utilities/xml_event_parser.py

@@ -51,7 +51,7 @@
         (
             "httpd",
             {
-                "regex": r"((?:\d+(?:(?:\.|:)(?:\d+|[a-fA-F]+)?){3,8}))(?:\s(?:-|\w+))*\s\[(\d{1,2}\/\w+\/\d{4}(?:[:]\d{2}){3}(?:\.\d{1,6})?(?:\s[+-]\d{2}[:]?\d{2})?(?:Z)?)]\s(.*)$",
+                "regex": r"((?:\d+(?:(?:\.|:)[0-9a-fA-F]{0,4}){3,8}))(?:\s(?:-|\w+))*\s\[(\d{1,2}\/\w+\/\d{4}(?:[:]\d{2}){3}(?:\.\d{1,6})?(?:\s[+-]\d{2}[:]?\d{2})?(?:Z)?)]\s(.*)$",
                 "match_element": 3,
             },
         ),
@@ -100,6 +100,7 @@ def escape_char_event(event):
         "WHERE",
         "LIKE",
         "NOT",
+        '"',
     ]
     event = event.replace("\\", "\\\\")
     bounded_asterisk = re.search(r"\".*?\*+.*?\"", event)

tests/unit/tests_standard_lib/test_utilities/test_xml_event_parser.py

@@ -44,6 +44,7 @@
         ("WHERE", "SESSION \\WHERE CREATED"),
         ("LIKE", "SESSION \\LIKE CREATED"),
         ("NOT", "SESSION \\NOT CREATED"),
+        ('"', 'SESSION \\" CREATED'),
     ],
 )
 def test_escape_char_event(escape_char, expected_output):
@@ -71,6 +72,10 @@ def test_escape_char_event(escape_char, expected_output):
             '10.0.1.1 - - [04/Jan/2021:18:37:21 +0530] "GET /tomcat.svg HTTP/1.1" 200 67795',
             '"GET /tomcat.svg HTTP/1.1" 200 67795',
         ),
+        (
+            '2001:0db8:85a3:0000:0000:8a2e:0370:7334 - - [04/Jan/2021:18:37:21 +0530] "GET /tomcat.svg HTTP/1.1" 200 67795',
+            '"GET /tomcat.svg HTTP/1.1" 200 67795',
+        ),
         ("- cisco dummy", None),
     ],
     ids=[
@@ -80,6 +85,7 @@ def test_escape_char_event(escape_char, expected_output):
         "CEF-checkpoint-foramt",
         "CEF-format",
         "httpd-format",
+        "httpd-ipv6-format",
         "wrong-format",
     ],
 )