From d6ad11e069a77b8d390ed7ef2977ffcc9117e876 Mon Sep 17 00:00:00 2001 From: Vadim Shulkin Date: Thu, 8 May 2025 17:36:07 -0400 Subject: [PATCH] Added --- .../plugins/custom/Base64InflateFunction.java | 29 ++++++++++-------- .../custom/Base64InflateFunction.class | Bin 5024 -> 5410 bytes ...-function-base64inflate-1.0.0-SNAPSHOT.jar | Bin 14220 -> 14388 bytes ...-function-base64inflate-1.0.0-SNAPSHOT.jar | Bin 11160 -> 11328 bytes 4 files changed, 17 insertions(+), 12 deletions(-) diff --git a/graylog-plugin-function-base64inflate/src/main/java/org/graylog/plugins/custom/Base64InflateFunction.java b/graylog-plugin-function-base64inflate/src/main/java/org/graylog/plugins/custom/Base64InflateFunction.java index 68d6770..0ab398f 100644 --- a/graylog-plugin-function-base64inflate/src/main/java/org/graylog/plugins/custom/Base64InflateFunction.java +++ b/graylog-plugin-function-base64inflate/src/main/java/org/graylog/plugins/custom/Base64InflateFunction.java @@ -27,11 +27,13 @@ import org.graylog.plugins.pipelineprocessor.ast.functions.FunctionDescriptor; import org.graylog.plugins.pipelineprocessor.ast.functions.ParameterDescriptor; import java.io.ByteArrayInputStream; +import java.io.ByteArrayOutputStream; import java.io.InputStreamReader; import java.io.BufferedReader; import java.nio.charset.StandardCharsets; import java.util.Base64; -import java.util.zip.GZIPInputStream; +import java.util.zip.Inflater; +import java.util.zip.InflaterInputStream; import java.net.URLDecoder; import org.slf4j.Logger; @@ -68,22 +70,25 @@ public class Base64InflateFunction extends AbstractFunction { final String input = inputParam.required(args, context); try { LOG.debug("Received input for Base64Inflate: {}", input); - String cleanInput = URLDecoder.decode(input, StandardCharsets.UTF_8.name()); - byte[] decoded = Base64.getUrlDecoder().decode(cleanInput); - try (GZIPInputStream gis = new GZIPInputStream(new ByteArrayInputStream(decoded))) { - byte[] uncompressed = gis.readAllBytes(); - String result = new String(uncompressed, StandardCharsets.UTF_8); - LOG.debug("Decompressed result: {}", result); - return result; + String urlDecoded = URLDecoder.decode(input, StandardCharsets.UTF_8.name()); + byte[] base64Decoded = Base64.getDecoder().decode(urlDecoded); + + try (InflaterInputStream inflater = new InflaterInputStream( + new ByteArrayInputStream(base64Decoded), new Inflater(true)); + ByteArrayOutputStream outputStream = new ByteArrayOutputStream()) { + + byte[] buffer = new byte[1024]; + int len; + while ((len = inflater.read(buffer)) != -1) { + outputStream.write(buffer, 0, len); + } + + return outputStream.toString(StandardCharsets.UTF_8.name()); } } catch (Exception e) { LOG.error("Base64Inflate failed: {}", e.getMessage(), e); return null; } } - - - - } diff --git a/graylog-plugin-function-base64inflate/target/classes/org/graylog/plugins/custom/Base64InflateFunction.class b/graylog-plugin-function-base64inflate/target/classes/org/graylog/plugins/custom/Base64InflateFunction.class index 96a87d0a8b11f22544b4038293aa0697d147226b..ed867d4c3a5ce0949687ebc5cc2ab0beeca88dcd 100644 GIT binary patch delta 1611 zcmaJ={Zmv`7=F&~WzXH+%ecT`T^J-sL(q(xfSTP(MQvDzvZM&~hg$GLn;T2}AwnN( zANGL}(beorG0EtQLdXTgq%TcOt^B=yZl+)S1Dfc$cL{NlX71c`&hx(S^Sdu6*E*5(<)VVpCm<#uy3r;J`vl>#^&9o%lE|68at-35|S)bSN0$wE25ep{_ z0ZB_RXqDE5mo&VLR|M2Vl+}dWS_Mi>pOSC(s(E*GpF{JZ%Ju=MxT&n15!UQO*dg?YmrIKH}9}5@!W&@4H-L{_e_gN*p&U7yVZDF+PF7ryMy4N|1{s zDCYSy`}{elgi^!B|BxB*tq6QUyntt5H5A+ii3(__#3EE7pXV=W(dZ2<#xRa?6&S(Y zaH|i(>=osvyOw%{BB*<>EElXQ+{dNEtGbPwpW)^{**F;^|||X zC5;2RGJ$s$h+$sy0qo`s_MjL0aDZzK_F%w92JH1Hg&*QM8{L?I$=!s#I$;S_4Ilsa z&{{*0f>_RBycxAT-ACs8(SR*zK^@{q)icqiAJ2qR$I+>D%HR)eTCyt z(S%hf9USCY% zJABV3XA@8v?8FarJqz~?^SUJpB~DBHC{bm9(-J!*x+JE7zfd4%phI2A3qqo2hSmNL zPpZfEQfF9$ye82c%R+hPF(~sHtU%MZj+0kyO);-^E3fC|Dp#($DUCzJ+@>6M!>o5= zy^JdpEN9g^N8Igz-B31F#ZQ?>MR=(lM00N8IF5{Bedg6z1CZe>XSU1>IFAcN9aR2j Yt_8$%`GS5?+&+|%ha0pagkRzQ2a^hFa{vGU delta 1192 zcmZuxYi|@~6n@^_>AthG(+l0GOi5`84Rk@=)Jqemh-KSY7P*El3G{-DWQ! zAg;A)RlE;iy>JH+FVG8aTTtp2TdHp^8zMgeVbi3aX9bf1hnQ@Pr^Ve zjwq6&0u9YQ3GYu?*B#rdW_Cno6Q_bKkYgOM(~P>SMi$ni?Km_ohWazDjL-BrdJiI4~^k16K{Jh zk!a{$6Yt@DZ);>r$TM*QC%y5=*~o_&m-xuU$M|GAVg4?<&BD-PQ38RUgg~fVn?SIC zfQ>bjwfK)>OH~mtdR-?yR<^nvxz&;p4EVd5cF<6+!G{~~WpqJevH z372UFKEoz*pZ8MB9@(SvS27EDl)N?!v|%|mqMn=4NZe}17de_1ILg&rAs1y+wUG7? z<{RW0_wFuhE6yNmhpbQu1zX-i>pn|PVdo4E+xiqbYG1JQIV6LybUUm-FIwRVTl%Lf zFm2tEmR`cBC2!lB!oOi@B^&*v|AM(|2-zcHtCu`>j92wz@cq&vBJP zrO5LIN2HUZ17G4Rir<8%@HJx^xl_1CT(N=_QCx?rm6|N*rcRTX^5-#*Y24r(Dsh}- zr&;hfMDB++&nl$E3W<`$tVFB-xheS)2#Jw-grWcMH7|XHK96Dm+ER>)kJW7ExDsmg zd{7G?7^Ic!*56;k2NOI7e96>qscl-Ex?HIK7USUnP(#bFj&IA0NOzT=#OvA>vp6-4 r&W=e&#S+2|d|G*JzJvPX3E(zq#a>>MIYq_Hn~?R6-Xh@sMg>^hAt zyHZm!B(hW!mCtnQn|JE`zWV2T|9GzVx!&u(?)!e8_m4X}>`pk$&UzcK7=)jn9}<;) z9%caLtfV#03h46SKnUj12cd@N00^r*BoK6qmZ25ALL35B>@J(L%5 z-YypkE#QS_UEl>oNaI!k0q;Y15DW%~FnPyR6Q@-O*Jxz+&F4?ZTeq(%U+{8VWst3< zDdykPlgcX$9z4VN0=p`2nry7g7-%h4JT+QO7-=cV`^Fw-Lt>boNsisUOs69`lGOHU zN)b#!ZSBy&Au6smc-)e4Is3dQT22jDTr0>R(DMBaE}Ic(22|3@K263g{L8mkJBbs| zbM7!#{XgIdLTEdQ8#&R6E1OKZfUwiwRtYKI-y`eyjblRGbbFqw2EWANa)ZvBe(bVT zLYnz(l*ZT#Ub_>G!_UGQ#~w#K$kdKpOhkN6_cm|aFYg?*DvXGg-JhIC5~f=0RTZZa zq@Q>j(RUzXnW0qnz}u;&dp@~oAH6fK?nXZrUEe+zJJ>z-SfsYpCn@-$k{+R!64+$~ zdpS5}u;?2U$C`F4WtSiyog-UkzV)DLyQnIxECmh;O^>zQ2s)re7e}~`^^Cf@48msc z=kjGdG)FNlk41=Vk66zbJ6AD1vcA*{6S&@F)rEOvR<_uf{FR7KUc0OWM#FJFDfy)U zUzurGBRnvH@RGZUAp(TFw1h~46i`wkiV=m(Byl|`TY3?ULbN6$qRPzFXr$la+y z+Z#`wWX=M%v@TP_0a2&1vmOH*IX7xV>E;;g-ODpLFV`iHiTqt@A0#X~GkIXR;Aod| zDsr5T9~2kvhdbg`XNtZn@;XXOts1uimyKJ`v~-z0L-x$0EPO4H{>@RE2dRv`7sU0K z>B`1`vw{$|v&y~8ZMqp0(em}t;$GcXZ4xoq_Nn97(LM)>*~FuwX{Eh~pJ>{ji#rfV z61W~1{?Ela1&q)+r}3hP5@|B-#)SLxxNO+T!MojKHo22-o9?%E%I#M1oyqLW{KNTj zPSmKI>-*bBbPYyyt9q;K)tDcAP{_DZebd?#sI_3pxl8plwZ`YW1Su~4i3MBH^Oh6& z()0*2e0a1^t=X#B3UlW$QCE2U1fWotXa z^I=JP~bFXFf7#djJdC`H@W=L^fK~IQ}XGEbq zFQ{sioDLtt*#_MbqtI;TR#ZBY!*KPJbFAdxY7Hgj2iFv{;P1Y9w%IT`CR)QstOPpD zk3VJVm5yc?rduClv!ETcIRm)r?bq>rxy54ewO0--feu@&;9x;OYFe1U(}nzZ*PS=Y zGo@$K#Ej2}dCYyU@eyC&&`%m-Q8O!Np}qTb?lp(DLQBOFlqMH?T>W4JBtmAc5wLdb#s-4z~D`HyOL!1gXzWCF9 zdL#?A-wf|^w-yR2mgy8UYt-@=c_gj8^2R>EH%>Oa1Z7%TGo6ZUa%gERKSns8kFJxv z*1tyDc_IMQbBR)}V3fjqw^VRARSbRb@|s34`KnCOXUub@zY^CEmx{FEC=hItmcU$j zAaZuVG0<@y_SgN~-OGOQ9Upi04ek(%vn9Hi%v|w%u@Ut(!+V6LPiM*W5(hUj=5dcl zq?p-dtm9J-LxnL$PR&>HFscbU9$R~ARlc7oyBj?gVyQuyETL_L*yk@}3Ty-iLqth!S~+nVL72E(g1x%&kKh+}30}4AD@AB45l}uW z-@nvyFHWGoCD*q1=zWzmM&z;6$WNUSeo5w?pX7P&bY-p0M)%vXIDcjlR*JzoNj|bp z4i~kjGAZyF;Od?Ha5bpV1pkwe;mfx|U4_5Iy*f*op7=^w=8HUasX;sKFTFdSnCB0& z>LDTW44Z&O_m5_|LZ^65SGyIfMi{}$(?jpyt5uDS_PuXdcKR5pyBoMOc>>;9HTphB@bN#!6Q1JQZb`S{D#bNjSA*zBhRpU8;4H+U^iu9j@Z0 zbvA>EP9O}0tOry0>6tX-Z!7 zhEI93UXWpOtYtMdxGgod7T50kHm=PAK4nJn%=r>g6j*rWfYbtmZ6Ji#{0F|OB>q>JvQH89^P6(?N}WCK;gKe5!$jK|jNqrKIOWOa%YkTgoCp7u#Rhp% zZe!4QyfURzJfeNf@9IM9pA(y7u1f>GkshAu*$Xo3n%~|SH!|O2M~x@p?~gwtwVgL`V+)Eamc zAchqKKd4}JLGZXu$sf{XWwDk@Xxe8s}txyK{5x9KkU>xAPh+{?5}ZQ9-A&gI}O6(A6wu#o>- zoZxTy5)^aSY!Ob(y<_ln`y;u16J^^WM6x2i!Fw)lH9_z1-DE(&K zuEZ%24YX@>n;7JTi79g#FANe;C2(0i0t%Y?gFQpQfO#7@OfTlAPU+tZQPDv`scOI$ P1`EXKi0nXM!A$=Jv62eC delta 2916 zcmZXW2{=^y8^_1kGh;7?v4k;*8QYi`+bv5>mL#$(S+ZRF9)sK)*&RY;8M2hEYl*DM zlC30UO=PL;NlD~CXa4v9{IBkLp5OVN^Zk9^_x+vscb?~*TCaFdm@$!-jvKlNGD=BpO{}lneuml(@tRQxg`)D(bF|)|*wlxjh;3#R7XVx4Qz62>)?wZ7^2qk8Edq3WiNadb+>`nSYJ`_}Q*v>XiK`WKmUet%%eJ9&0I z)`qhQt{R~RO)^W(9#~d&#+bo~B&SIwwK}@wYBol@dQH+OjKu+~j@rtP)KL{1Y7%TD z#pz&fW#m}GwkQ1m^sXCmv=7m;w|ZNLOB65Jk1)WHixD!MKVYl658LhiaV&K5uma5o zuG+r3cn7F}TB}`SX`|C(W|nE~hV^0ASdl`8e_4^WfeIg^KTX}IrXCowyToG80v?^y z&TqhViPmJaB_qh%zJKk)SU3{Lu1g>hJ1*J29gMf`lNaq>M0~6tw65F}zrNVxmtmi$ zehGK^@rod+LlgakE~+v_#k2AD!E#-3sL9aBV&Anu$+-pk*Dtc~KAh?e`b6#-m(lih zaWzA!wcXm`JsoRnSk`Hrr`dv4cQz8rO+e-NP4=vEK@*%WnON{Joo&0WT_S)dJt0?g z6~0t!<0$d66uDv#xjFDzJ_=+g@Dz zS;wZS-1iN+uD_Iz=qZUwKrj=n)S5o{(VvN2OIMlG%7~V!4vk&2IK}^3?SUO_)V01G z;N9h^ML_nhO@`{|N6xZ-iH^*(W*Zhp3KtEyYz7^!fu^Hy)2*Gk? z`~IjH&r}a>J?#>MezP*N1$K^P#n4(Y$LBQ0SlV;`l#N#vVi(h@>z2OqNiOV5rT#;c zM}JJf!|mVQ+U3Z;BlVSShcr^#=fCA(ow6GnnK$n|u&`!RoMF}Q-j4)B&csfD55(7?8Uskw;XSZH@L4PJaAvNHm)wk&< z9f3c3w)uvb*a*S+vJjbs4}aeFQp-m$lYgGqX$-%&f;idV-zsgO94@-HV6I_&lcD8s z6BC8s6sHS+@dF-|nU}O*{eBy}zij8zz;tj(yMJ)pNawj^(9BzTHqt8-ED!sGS?hK* z%lJ=0zRK^aZA+fC$`N5q?}WuzpSC-U58Myq&m%p<>s&Y%9yhxswHb;;myF4-xzX|Q zuvd^8B8vBD=~el5A#+=I?*zV*wQeuitA{3X4|&&>Z_v2XB&OnD2-M!o_FxQn&r44G zA^bAKPw9@|iG$EM=T*|a_C_b^xzN)0;}tHmKcVW|a+3^Ig-xwhI}CenLm>iZ>Eki) ztW~QcusTrs^F3~!^ZUC70|~mW%X0(I65eQkI`+J0(V#X#S1fqRTT*burh>lW!d#Gr5%0)4e?GVZK=|9InK)?gREf~ z2QH^Ak>v#>X{W9`smEJ~|HIsrZ8tf|RwI)31Nxh!`n_%m&gmKk3Af~Z+J$xWH};-A zL~|ngAjm-BM3`2m(56x$L0_39W)hY5DnVoJ<$#x{_!dtty+kNC31uULa_^eWmvKZA zAB_dR@tR3GJl;&Y8Ho695S0Gc+oG0@tuILEW0&Z(amfqGmy=z#4_mN}cbQ`QAG4pS zo_A~gA{q5qLa91OOQ@~(K7d%4Dp(QT8Qqk!@(XEeqsv#BZ3yd+5FvKYF4)E3YUqF3 zv6Hao&usIOt5yOr?{)%*!Uh?)Q=84CPC?gbZ+x)R=;#TT3m&N+>e$s4?!-Q7`H35h z-sdVfq%kHkGKC?zF)@q~NIn+?^3Sh3u*G_&2F|ib1Af6VTxV`640keO`1$`ta$-p1oyA(5M?Hp7g(1U0E@#FkkA=k zpa6jaj1{PnwiHJe0eCAC|Mk44U%b{FnIRB2H06CbvaB*NzzERBvr*Sy(3eh|L;>zm zhWQaNUX%hlf|c_z$P@Wu5Qu}P2lkg99m642M*g01_Vjdicl?Do+9CEM71#iKoDf(b z5{INQ0&;O^A+V)m#L+S|Wv{@#N*)QwpfLQvA&%M)K_w*gI2uS%k^~xYuzzia=8;Hu z5Htj9%~8Up!MiiSZ+I?hSXZn_xh@4ap$x+#Vf@lmupZAx1uwM5uiz+v5@kpq0pCgk Mn|O5w4;j$?4!(y0Pt;~tm8?WB&tyJlZust~5nyO5(TAB4^6UFd zI)u;ePqWxWkDuZ7r^azXE*d>E*uYslJ}V&C;7gaO0@BEfT^wo6``~#5UTp!+D6K?1 zofs_v)UCrjUZ87yrnNNW6O%dj6kiq!bX&X;p=pzhNN1L$C5AXc5ku}SrfHJ@aeNcj znx-DU9EbRt;$hr&R@OdXgAWlUeKsMR$VV~x4J$$+NWS&Zr5{H`F@q_bfz_#JFTJvo zzj&nH7ec=g+~r=38tk5WBT!rH6(9IYL6cAm_;=|-X9vf$m%Rg`S<^1XoFe4wTO{+e zRWe202`jh0;y(nN9&3IWa88vjf^Z(|8Fh9VgwCnm%8??gjN+Q#2pDq6QErh|&cd1` zEr}2MaLvie+e^sw4B;`^dtseiR_U>fN1i+qvMYYxQq#}|wJiJk98AactYp#4AsN8a z5AZQXYW(u6kgccQ>|TnX9TNHrOn2waXjfsTTQxw4QX*JRcOQ}W5jCt zVWUmzDf+ofswELuzJd%5J4bJYSC|V_OInwK&VZoZ*iG^PJM&?U zAl(>eF0?j>cXwVPPvr0??}(aorX7Rg10$TqDadiU+MozuKipOgJ6G^ip37EJVneTm zTA|l+qq)oIJ+fy>+{D`i>DzQwW*9mMCKvZ!e5+!8EBc&25mN0R`q!O0IUMYk-FU$((PSxCJwoFW zJ_CAX@J08SMb@OtzUz~dGC~;dxwO8t-|Z_hua3GnZ$G`Hp*^Be*;{F?$lUP~M@Elo z8Pr}D-wYI6yjxFGY?$Ha1)Tch@(v=FOeb0u=J@Mxc6lUbn|^tth1-DPTFnfLVL zuGWrvo5eXUo$yfqchDBK;n=4iWBRfR zh2fj?HY`Yor4sL8o?lXO2;|+ToULkmc4?aALb9-4ZU}ktXN{N0E?X;ph($>&UjX-> zI`gtAxCLA+f&i+s!Rqh!wwwZUT;KWCzKzk2`Pwhh)`gQRx%0I4y{6$uIquhI++`=k zVCFGru~FqwuO6{{_0PlnuI8|SLa9z(qXt!9f!C6#_0QIR z-qF%2MdAkKHPcB-&up3-N*xKgIp{jE2mPDGlb8K)J$HdpIo(9&)=J*RBw_UVip|r3 zr2A3@UvV=Ef5h!xEEZ_P10bb%RmftgKXPHf*57ss`bT4y(3($7$Cs0RgU4afmWEFH zbN75cu&;hk^%$XP(OFWxhJ)85(ecMAj zd+d2v`sPAJzZL87XBH?)Fj!Yemv%{^g4Pr!0FR{Jf1VSn2!>6ZcpEfa@g&%p?_2cz zO<;QBJ7J9{{My||>dAj-K6k^-w5HdCf@B#Me#@?3jIvb1`N?ZnO_S>U zLV?(8$Cr8&*3iYOk16dop;e(67uB1oOmr+^C}elhRj!`vGT4mI64rR|kZc%qgGYEo z%#E+S^E780G_pR-EP1Tob@iH(6}8vlmmle}^7_hWVH~j8jr|dx{5p@VN9GTu5kyR< z*jKXu&yd9%Sp#Vi(+b+uO{9NrLa`a ze}HbQ*DAOuRU|UjDExz4*HM-3NK4k>BWqu1Q z@Xx<@PT~`TXP%KSDuWtqD6{?hU;$*8(Plc zc=x8FQIky-{%CYG`NWh7`@*sed(eBlJh4+GtbNSq{->7zOze+2uMG5tligA>K1uDW z{P?Wbz}!|E)t$tD-%oyL62;8iQYAWM13lmLt;~5&y!H4_JAK$Lq!CmP8S!V%5E9=} zxo8x{9?3^h{X=;sha~eJ*;}&eN48CN{up0GMh)p-!?p4e;8h4U42-8{L!eYw1q>Jt z``flEXn^_o|3(EA0enH|Z_Gt$fW3dE4x#|?D^aQeSeWXLmOr{91ud>`g9L#t8rvEu z5-rXv2YE#L1S?ya9|H^j^8Y4OLjwJ4$^63tpiP4tNGc#BM?Hao{(khvf6fkp_>VaX sb{_@JsQ?B8Mu{DwCG`NK2@3IG5I008}okqjjQ{fV(NECK@kiIZUhN`LEn6jvR75834G zE`wkwlnqc8o3=?HY@wLKCLpENf+zZDmx}b&@KVbKIDj^J3HaOwzL)zVDpMd9IoC zdP^q)bsbj5@{SACG&PR}5frGkGTFQrMi?6<3q-)ynQSumceWeo9ja zoNlUG7}`VFiCq%A4LpE70*_Xbo6P4tXD(I@OMhnCHa)cjkgyL2U$#Jh)eH+`FFqyl zpn*m_B+$DaxqpjBE{B(#S`72qb%t@Z)Ma3LL||LqwKa|=r~H6TE~2IxEfV_->_@A> zV0ASM1TqYvK&om*b4NF00v$cRU%9BcX62ZfRJ8A0|C!dLGnaL#q+Crp8V7X&wd%Xa z3>?O%S^8NGgq*+|O%qiEQq{eecwAu1?NQc#95oO}JAX^URbJlBj9khxBgy3%>9);W zuKFfv<;QfFV4pr!HCVUn9)H3>C%OcJu6jCexr+VgwWfPg(CMag?RP2R=OcwXH`;J7YIYY zX+@_UH-EaKt;M6yJ--pBa9Sc^U;u;6^zEY9h*N4R&k6NNg<@N6Uh`N8XYi!NSp&lu z5!maKWGp9^oH5;;^2p0lG2K*m@tGA+J37)kc|@Qgv5L4v#O#dWvl5@v9c5f#$6AB} z_cb-IHZ+V0d|u)U2A;yCz}6x=*;viR($>Sc*nhkPj@;SRa;K@F#>A9F(m)Dov2OC7 zWtZlOz^1hFMqRtCbJwD^%cvSlZz(Q~83{{UJ-g_11ww)Cl{(=>mxL{_dx`B?D;v{2 zs$T<46I#&w=Cr)Gv~4xH3&aFtpnnMUQ< z>09^Qy25w+$MYJ{2oF1XH>r9pjp&Aoa6Olq=-%f2j4IesJU~zvgcPIe>i#;25Uqc>fTsEb1w0z~0O9ePmUq!GT)?6FwgQe6&~de_?*VE7j*>Ud9kiXBZ3lMa z7^0N>AkUX{HkNc2{d