github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-29 03:11:02 +00:00
Code Issues Projects Releases Wiki Activity

fix(userspace/engine): make sure exception fields are not optional in replace mode

Browse Source 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
Jason Dellaluce 2024-02-22 14:38:54 +00:00 committed by poiana
parent 1bf6a83e31
commit e211e97e2a
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
userspace/engine/rule_loader_reader.cpp
View File

@ -650,7 +650,7 @@ void rule_loader::reader::read_item(
if (check_update_expected(expected_keys, override_replace, "replace", "exceptions", ctx)) if (check_update_expected(expected_keys, override_replace, "replace", "exceptions", ctx))
{ {
read_rule_exceptions(cfg, item, v.exceptions, ctx, true); read_rule_exceptions(cfg, item, v.exceptions, ctx, false);
} }
if (check_update_expected(expected_keys, override_replace, "replace", "output", ctx)) if (check_update_expected(expected_keys, override_replace, "replace", "output", ctx))
@ -771,7 +771,7 @@ void rule_loader::reader::read_item(
decode_optional_val(item, "warn_evttypes", v.warn_evttypes, ctx); decode_optional_val(item, "warn_evttypes", v.warn_evttypes, ctx);
decode_optional_val(item, "skip-if-unknown-filter", v.skip_if_unknown_filter, ctx); decode_optional_val(item, "skip-if-unknown-filter", v.skip_if_unknown_filter, ctx);
decode_tags(item, v.tags, ctx); decode_tags(item, v.tags, ctx);
read_rule_exceptions(cfg, item, v.exceptions, ctx, has_append_flag); read_rule_exceptions(cfg, item, v.exceptions, ctx, false);
collector.define(cfg, v); collector.define(cfg, v);
} }
} }