From 5b4b7f96ebfc58dfb5876790c532bdb117e93350 Mon Sep 17 00:00:00 2001 From: Vadim Shulkin Date: Thu, 8 May 2025 17:16:33 -0400 Subject: [PATCH] Added --- .../plugins/custom/Base64InflateFunction.java | 45 ++++++++++-------- .../custom/Base64InflateFunction.class | Bin 5043 -> 5024 bytes ...-function-base64inflate-1.0.0-SNAPSHOT.jar | Bin 11982 -> 11160 bytes 3 files changed, 24 insertions(+), 21 deletions(-) diff --git a/graylog-plugin-function-base64inflate/src/main/java/org/graylog/plugins/custom/Base64InflateFunction.java b/graylog-plugin-function-base64inflate/src/main/java/org/graylog/plugins/custom/Base64InflateFunction.java index dac3bea..68d6770 100644 --- a/graylog-plugin-function-base64inflate/src/main/java/org/graylog/plugins/custom/Base64InflateFunction.java +++ b/graylog-plugin-function-base64inflate/src/main/java/org/graylog/plugins/custom/Base64InflateFunction.java @@ -27,18 +27,23 @@ import org.graylog.plugins.pipelineprocessor.ast.functions.FunctionDescriptor; import org.graylog.plugins.pipelineprocessor.ast.functions.ParameterDescriptor; import java.io.ByteArrayInputStream; -import java.io.ByteArrayOutputStream; -import java.io.IOException; +import java.io.InputStreamReader; +import java.io.BufferedReader; import java.nio.charset.StandardCharsets; import java.util.Base64; -import java.util.zip.Inflater; -import java.util.zip.InflaterInputStream; +import java.util.zip.GZIPInputStream; import java.net.URLDecoder; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + + // @Function(name = "Base64Inflate", description = "Decodes a URL-safe Base64-encoded and GZIP-compressed string") public class Base64InflateFunction extends AbstractFunction { + private static final Logger LOG = LoggerFactory.getLogger(Base64InflateFunction.class); + public static final String NAME = "urlsafe_base64_decode"; private final ParameterDescriptor inputParam = ParameterDescriptor @@ -57,30 +62,28 @@ public class Base64InflateFunction extends AbstractFunction { .build(); } + @Override public String evaluate(FunctionArgs args, EvaluationContext context) { final String input = inputParam.required(args, context); - try { - String urlDecoded = URLDecoder.decode(input, StandardCharsets.UTF_8.name()); - byte[] base64Decoded = Base64.getDecoder().decode(urlDecoded); - - try (InflaterInputStream inflater = new InflaterInputStream( - new ByteArrayInputStream(base64Decoded), new Inflater(true)); - ByteArrayOutputStream outputStream = new ByteArrayOutputStream()) { - - byte[] buffer = new byte[1024]; - int len; - while ((len = inflater.read(buffer)) != -1) { - outputStream.write(buffer, 0, len); - } - - return outputStream.toString(StandardCharsets.UTF_8.name()); + LOG.debug("Received input for Base64Inflate: {}", input); + String cleanInput = URLDecoder.decode(input, StandardCharsets.UTF_8.name()); + byte[] decoded = Base64.getUrlDecoder().decode(cleanInput); + try (GZIPInputStream gis = new GZIPInputStream(new ByteArrayInputStream(decoded))) { + byte[] uncompressed = gis.readAllBytes(); + String result = new String(uncompressed, StandardCharsets.UTF_8); + LOG.debug("Decompressed result: {}", result); + return result; } - } catch (IOException | IllegalArgumentException e) { - e.printStackTrace(); + } catch (Exception e) { + LOG.error("Base64Inflate failed: {}", e.getMessage(), e); return null; } } + + + + } diff --git a/graylog-plugin-function-base64inflate/target/classes/org/graylog/plugins/custom/Base64InflateFunction.class b/graylog-plugin-function-base64inflate/target/classes/org/graylog/plugins/custom/Base64InflateFunction.class index 05208f88886416d9e31e2bbdae97232a3e576683..96a87d0a8b11f22544b4038293aa0697d147226b 100644 GIT binary patch delta 1670 zcmZuy`%fHI6#g!|aA${s5{#6A080dcwn(Uyqzh6CSjwB0f(5E|*d4Y@XLoUSKxwTj zAq~-LeT-IopsiZ5K6%syindh~P5i;c#Gg(4J50oLXNlC-WOvWK=brPOGv9aa>`K|? zGWnOkZ`=g%2!33W|4NJJqea1^IK<%U>}h4l?u?qjs+ciaGgj3Z4F+|yPQqb^lB2p` z4^8R;ZzwW8VR=WRrngCp>9sX&kx@glbf5R^xpcIngQHVH7rGg;?uKGW4d^2iL58yO z&M|FLtFnLPJ9BzQ#&o|`S25s0FOF~=RnUiHb{6l*9Kd57#}(|sAVaR*$aC#!uBH#; z1jpkFp1?`_DnC)CVT8l4AOM}pI>-}N$f!zo$dD1#t$x$6OQrJkAWm_FMDCba%1M;cZ38_}3&?3RAf2EO;4_m<-c+>t(o*$C&7UnqK zR`3qqrPl9O`jFIO~^ZXi6UrmiBo3e%USrX?`p z;~S_QR5>NBV#+58pl4OdK~g23M+7~mdKP`$SuH^ENh(*R1ZGrz%jXvHFNhi!RQEbA zy1^ESphoBjV;WIdbcd!9&%hXFFiXxE$GRXGX(0Z97G#hnxoAZR4&x!TQF=S=I?#_! zX!H)!(M|bXl-)+zJvdMAmrFR}Fg8kTw333K;u`VWPdJ~EvJzo5<8ypLnw8*W9AA>t zP2m0biULy!;y!#0(JN88MYmWjVcC&!4lB4$@@3!xfz88(ZzysI?oH}~bL4X*IMz67 zozD$Umz!}+Z^8rVp5wSUr&A|H+9X`}oiV~an{|*>ZW0qig{rBbi!9$IBz}F7mMIQp zVkE^7ZVwCJ>VAX#o)jR9EPW+>o19be^5RhD$4GULr5M1F({+C8zB>h`*H- a+`?_LdF0O~hQD`vP=R8{21%12;Q0pxzHQ?G delta 1797 zcmZ`(>r)$56#w01le-Cvq-E%^bXugX5LytO0jgoD5-B#NJo=&rs<^-cDIrP2h8EOD z+RixGYQ^=@hn3bBJ`qX@SgQ4tqy7=j_{|wV*zb14bC($S0F&%Jd(S=RcYfz__eRNV ziTk&I@B9d04}O?&|KrT6!(NVh1 zbHd2DyAgq1M2RaHgh646dv}^^K%5RKIEB-sITa5Xlm(|O0s%oSf)NET;}r(kh*Hv_ z2xV5BW*OEZy%nT13niy{NzToS;EaMKoP^XBjt=S~=oz!b9ZZUZn)jaW(ql#_8sT_@ zVVgzT!U%-Jdao9)jrS%7^oWtMbK@f3|ed;*l|7$cYgvYKYd=ery8Ss6IWq2N*EpaOZczeXntSp%E!A+D2T_y|uC z_7(HGrz$D@w~`l7Nw`&TqZ;|xjV*Wr593K}C;bY>jx@$Hn+d|A-Uu#4)+82LgfqYM zHVSr?rSSAmsBS91g=bR;ETG9JE#QbMrO@VcETSX02rZ~49rNf~L{CtfN8dd9ea=Nh zg7b*^_y!4gWuL4%RXK%|!D^Rn0v?sCvOUk0LSl01Pn9o&r!eeut2~8QRc8vXsqSfV z6Wd8BK9?%1WPeVT@AuEVg=Tp{xS&qR@mY_1{SZg+Fsj+@4W*s5c({CRdu^;V7HlPnp z6ttNDn+T?kU|KMZgP5Zan5cY=s@h1Mxq+LIaSXeNz$X^fL--V*QSbKPBtFL^)nBFA z`GOvaLS4X@8Lm9{)xA5@GV%p#cQ!9f>)4tRh9wnS0o^{l`+Mwf`~IygxIG-_GNOT>Y%36w!uFU~3iX*Ggy zyy&T=DfNqqr?eiY^z0=0PBEfycZ*bQRk;vaFr1N diff --git a/graylog-plugin-function-base64inflate/target/original-graylog-plugin-function-base64inflate-1.0.0-SNAPSHOT.jar b/graylog-plugin-function-base64inflate/target/original-graylog-plugin-function-base64inflate-1.0.0-SNAPSHOT.jar index f82d40f70415c70df4c0dff5995fd901b5500aa5..475f2a1e93060077dffdf08e35df84d059d040cb 100644 GIT binary patch delta 2215 zcmV;Y2w3;dU6@x4P)h>@3IG5I008}okqjjQ{fV(NYXJgjd6S?4zXJVENf+zZDmx}b&@KVbKIDj^J3HaOwzL) zzVDpMd9IoCdP^q)bsbj5@{SACG&PR}5frGkGTFQrMi?6<3q-)ynQS zumceWeo9jaoNlUG7}`VFiCq%A4LpE70*_Xbo6P4tXD(I@OMhnCHa)cjkgyL2U$#Jh z)eH+`FFqylpn*m_B+$Daf4PfBE{B(#S`72qb%t@Z)Ma3LL||LqwKa|=r~H6TE~2Ix zEfV_->_@A>V0ASM1TqYvK&om*b4NF00v$cRU%9BcX62ZfRJ8A0|C!dLGnaL#q+Crp z8V7X&wd%Xa3>?O%S^8NGgq*+|O%qiEQq{eecwAu1?NQc#95oO}e>+RURbJlBj9khx zBgy3%>9);WuKFfv<;QfFV4pr!HCVUn9)H3>C%OcJu6jCexr+VgwWfPg(CMag?RP2R z=Ocw zXH`;J7YIYYX+@_Ue>b|Kt;M6yJ--pBa9Sc^U;u;6^zEY9h*N4R&k6NNg<@N6Uh`N8 zXYi!NSp&lu5!maKWGp9^oH5;;^2p0lG2K*m@tGA+J37)kc|@Qgv5L4v#O#dWvl5@v z9c5f#$6AB}_cb-IHZ+V0d|u)U2A;yCz}6x=*;viR($>Scf7rYPj@;SRa;K@F#>A9F z(m)Dov2OC7WtZlOz^1hFMqRtCbJwD^%cvSlZz(Q~83{{UJ-g_11ww)Cl{(=>mxL{_ zdx`B?D;v{2s$T<46I#&w=Cr)Gv~4xH3&aFtpnnMUQ<>09^Qy25w+$MYJ{2oF1XH>r9pjp&Aoa6Olq=-%f2j4 zIesJU~zvgcPIe>i#;25Uqc>fTsEb1w0z~0O9ePmUq!GT)?6FwgQe6&~de_?*VE7j*>Ud z9kiXBZ3lMa7^0N>AkUX{HkNc2{d`$$ zFB=+@uq+G${fU#lEF1!>7?a#A9RmG{llv?j0@xUn;VmVTJ}nFa{fU!IEgS+F8I$2H pOOv%NDguBRli@9V0%IeS;Vn;-t}YS|6aW+e3kLuIcO(D+0061OBRT*8 delta 3054 zcmY*bcTm&W8jYcM2m+zGv;;zLS*kP<=}j;~sEddSNKgn6fu9J34oavhJrorzfP~(= ziu597H=^_o3!y*QndjSg?;q!!xo774?#w-Rz6?~KBeSIm6*VIWL=OVV20dejfn|d} zD0yB0BLWDy7n;r#!4+%-pza3nkMM@x7dtfWtyaJjyM_N^C-f!?(lDBfh$GSj={V$s zv8IBgYPY-67Ee7=1|-nvlEvqGCTRPrLF?K=DVCIOS^QwqI@=sWiqmf3u$yBx^ul5Ap(`$A)tYd54P)3L@ z|5{45NgLLEKQJ5#8GpVRrf=J-RYtzAzerJw6vily%B$=|ec;?PTp7g3t#PVaCi&Ff z#H@A%PRJlUwTkOHaZmK?{Wb!bh2VuF? zcUYvZkrV~R`-;r}E?VuVzal(x&w3`%lFRZP?ywXewMlQH{SJ~Rv|->?P-aN_#g`&MyhzUUun;$AOkT+{%0*Oog|cGez(GY@za;K9aFnKTu#B050n^0od$pKGP0d759C zaf)lXwq`*D+J%S_SAN+U(VXS}Ao;`1-qeD%+6O-Dsy4-5%Ullx6+Gl&n?(Fqx7y^i zt7D({SD*J}Ag5k8KazYsn(KE^`~w*-XBcet>d2#?ti*&;4(4?RT(8#bMrbdsludqIrk-q7;>)(3b-b?b!NXkG zt_1mN3;EoZ?SNT{J8(!WHlg70KHt$`85~^6>hqy@#y}aDUE#*csd?m!tqIDe$=x>o zt745(m{WBt$#kW1T;fj$2W4qeEKds)CA)nOSzmIo%&Ih2z)O`;Pvu>gC`ZJ@!J(CuO6# zw+|re3<6U`bBNF80UvUTM&tSy+`-C9QSk2O`Z$XXE?TQ(KkGGai`)ACJxhE`g|NQ>2!lx4i+5YkR20U0Ql}Q6JcrEM0W}!MT+vq(u+Y z8<@LO60toLLYDE#M@kmtHSb~=Iy^m36MGfcA+q8kR(7qZf-kUO8NM2G#g7fNG8~Ec z{Pt6v@{W}rZl00PI{u(;H~$1-3~IAwdnj@=~NrZvDePOkGP7$$mfC)mXRJ72+TKc-dkk?Gmrp)#DLA ze1)hLxf}>qQO!V*<`)O8@IQG1nS?cCLQ+npEQW?C$k4WC!H%FK?y-dcH%LK)>v$gmNVZcSQRjUupwQ4vY;^X~1>Mu~d?f&_0ZzAI+E8U@D_B?I$`5 zunpFNP!nb4+jPtOf3DPs+#t*k2H3_}WE9RYt}{?#n&P>9j`?TydXdeoNiIm}T-U^X zAMPyj`;!Z;r&N|EboA@fIRQ925U7Ha;3_ImfoAk%=0F6L*n|GHU<3^K5@6@K(9mjrS?nRXjZq zYs5R1kXz|C^5RdcUV!rQ2`fk2IgO{4N=>0TC)Dp_N2t~N?+PXB^W-x(L>*cl@mp6R_WSCE3QxZVK^mjFn;u9iXe~lD9vi zTT{#&eNLg8U|TI0y$l4rp&l7CFzaC8H7$k^2Mh%LBj+`SXZ4Nt-@>-APaQO)HTg4! zY(`TDv#~)TCJR)yn}1{!;G4Wy8yucQPz&5~3vIM0L;I2EnS~!r z`5ISo4-;?c8k6S))`D7|U`BVqdrs+js z!%b(S2jcpZ)->RlqMz|}-M@zy%Eus{Bo25gm=%M9i(+L zmj$--r~UcaTk&i#2sB7tQOkXJ;e7feL8Z>&2UPnEDqy@$Oy@FE40#UqVr%DvYAI}; zMK-9!{#P;xC2)VR5+lJEtVl>=WF|O@OM)Gk|B-d#s$e_Tf2g>`@8C4ZKlGUdpU`=R z{?`Bq1p8N>h+%KJ&y0f9=aC|0O2~tAcnO~*0PravK^J_H;DUgk_Y;i}&`#tBfy}Pj z=*k$G8_0RPV%_h{S(;n`U!?l)kp2Hj75!C(9ki-j$4>x6VFY?fW})*7{W?1%M!&?l t@#x%WLI5Ns!EOR))PiszDFZfupHVw*OA{K}b2r!7b~^hh?8VR3e*o&&e|`V}