diff --git a/graylog-plugin-function-base64inflate/src/main/java/org/graylog/plugins/custom/Base64InflateFunction.java b/graylog-plugin-function-base64inflate/src/main/java/org/graylog/plugins/custom/Base64InflateFunction.java index dac3bea..68d6770 100644 --- a/graylog-plugin-function-base64inflate/src/main/java/org/graylog/plugins/custom/Base64InflateFunction.java +++ b/graylog-plugin-function-base64inflate/src/main/java/org/graylog/plugins/custom/Base64InflateFunction.java @@ -27,18 +27,23 @@ import org.graylog.plugins.pipelineprocessor.ast.functions.FunctionDescriptor; import org.graylog.plugins.pipelineprocessor.ast.functions.ParameterDescriptor; import java.io.ByteArrayInputStream; -import java.io.ByteArrayOutputStream; -import java.io.IOException; +import java.io.InputStreamReader; +import java.io.BufferedReader; import java.nio.charset.StandardCharsets; import java.util.Base64; -import java.util.zip.Inflater; -import java.util.zip.InflaterInputStream; +import java.util.zip.GZIPInputStream; import java.net.URLDecoder; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + + // @Function(name = "Base64Inflate", description = "Decodes a URL-safe Base64-encoded and GZIP-compressed string") public class Base64InflateFunction extends AbstractFunction { + private static final Logger LOG = LoggerFactory.getLogger(Base64InflateFunction.class); + public static final String NAME = "urlsafe_base64_decode"; private final ParameterDescriptor inputParam = ParameterDescriptor @@ -57,30 +62,28 @@ public class Base64InflateFunction extends AbstractFunction { .build(); } + @Override public String evaluate(FunctionArgs args, EvaluationContext context) { final String input = inputParam.required(args, context); - try { - String urlDecoded = URLDecoder.decode(input, StandardCharsets.UTF_8.name()); - byte[] base64Decoded = Base64.getDecoder().decode(urlDecoded); - - try (InflaterInputStream inflater = new InflaterInputStream( - new ByteArrayInputStream(base64Decoded), new Inflater(true)); - ByteArrayOutputStream outputStream = new ByteArrayOutputStream()) { - - byte[] buffer = new byte[1024]; - int len; - while ((len = inflater.read(buffer)) != -1) { - outputStream.write(buffer, 0, len); - } - - return outputStream.toString(StandardCharsets.UTF_8.name()); + LOG.debug("Received input for Base64Inflate: {}", input); + String cleanInput = URLDecoder.decode(input, StandardCharsets.UTF_8.name()); + byte[] decoded = Base64.getUrlDecoder().decode(cleanInput); + try (GZIPInputStream gis = new GZIPInputStream(new ByteArrayInputStream(decoded))) { + byte[] uncompressed = gis.readAllBytes(); + String result = new String(uncompressed, StandardCharsets.UTF_8); + LOG.debug("Decompressed result: {}", result); + return result; } - } catch (IOException | IllegalArgumentException e) { - e.printStackTrace(); + } catch (Exception e) { + LOG.error("Base64Inflate failed: {}", e.getMessage(), e); return null; } } + + + + } diff --git a/graylog-plugin-function-base64inflate/target/classes/org/graylog/plugins/custom/Base64InflateFunction.class b/graylog-plugin-function-base64inflate/target/classes/org/graylog/plugins/custom/Base64InflateFunction.class index 05208f8..96a87d0 100644 Binary files a/graylog-plugin-function-base64inflate/target/classes/org/graylog/plugins/custom/Base64InflateFunction.class and b/graylog-plugin-function-base64inflate/target/classes/org/graylog/plugins/custom/Base64InflateFunction.class differ diff --git a/graylog-plugin-function-base64inflate/target/original-graylog-plugin-function-base64inflate-1.0.0-SNAPSHOT.jar b/graylog-plugin-function-base64inflate/target/original-graylog-plugin-function-base64inflate-1.0.0-SNAPSHOT.jar index f82d40f..475f2a1 100644 Binary files a/graylog-plugin-function-base64inflate/target/original-graylog-plugin-function-base64inflate-1.0.0-SNAPSHOT.jar and b/graylog-plugin-function-base64inflate/target/original-graylog-plugin-function-base64inflate-1.0.0-SNAPSHOT.jar differ