mirror of
https://github.com/falcosecurity/falco.git
synced 2025-08-11 02:52:54 +00:00
Grammar: parse array lookup in fields
This commit is contained in:
parent
e75041c4b9
commit
96942f8034
@ -225,7 +225,7 @@ local G = {
|
||||
idRest = alnum + P("_");
|
||||
Identifier = V"idStart" * V"idRest"^0;
|
||||
Macro = V"idStart" * V"idRest"^0 * -P".";
|
||||
FieldName = V"Identifier" * (P"." + V"Identifier")^1;
|
||||
FieldName = V"Identifier" * (P"." + V"Identifier")^1 * (P"[" * V"Int" * P"]")^-1;
|
||||
Name = C(V"Identifier") * -V"idRest";
|
||||
Hex = (P("0x") + P("0X")) * xdigit^1;
|
||||
Expo = S("eE") * S("+-")^-1 * digit^1;
|
||||
|
@ -60,6 +60,10 @@ good "a.b = a.a"
|
||||
good "a.b = a.a |"
|
||||
good "a.b = a.a | %evt.type %fd.num blabla"
|
||||
|
||||
good "evt.arg[0] contains /bin"
|
||||
bad "evt.arg[a] contains /bin"
|
||||
bad "evt.arg[] contains /bin"
|
||||
|
||||
bad "a.g in ()"
|
||||
bad "a.b = b = 1"
|
||||
bad "(a.b = 1"
|
||||
|
Loading…
Reference in New Issue
Block a user