Membership operator doesn't work as expected for Var expressions

[google]

Membership operator doesn't work as expected for Var expressions

[the80srobot]

Hmm, six.string_types should contain basestring. I added a test case and unicode works.

I apologize, but I actually don't understand the blob of text - can you tell me what exact error you're getting?

[Onager]

I'll update this a little more when I have some more time, but in the interim:

I'm not sure what I was seeing to think that six.string_types was just str in Python2, you're quite right that this isn't an issue.

In the debug output above, the expression is Membership(\n Literal('a message')\n Var('body')) which should match the body var, whose value is "this is a message". However, this breakpoint was set at

dotty/efilter/transforms/solve.py

Line 775 in ee0f320

return Result(needle in values, ())

so the function hasn't returned at

dotty/efilter/transforms/solve.py

Line 772 in ee0f320

return Result(needle in expr.set.value, ())

like I think it it should have.

I suspect the issue is at

dotty/efilter/transforms/solve.py

Line 770 in ee0f320

if (isinstance(expr.set, ast.Literal)

as expr.set is Var not ast.Literal in the debug values.

Hopefully that clear things up a little. I'll try and expand a little more when I have a bit more time. log2timeline/plaso#899 is the parent issue from Plaso where we encountered this.

[Onager]

And I didn't actually answer your question: the error is that an objectfilter expression like: `body contains 'a message'`` doesn't match when run with efilter.api.apply(expression, vars=event) and event has an attribute "body" that contains a string "this is a message", and event has a protocol definition that looks like this: https://github.com/log2timeline/plaso/blob/master/plaso/containers/interface.py#L58.

That wasn't particularly eloquent, my apologies.

[Onager]

OK, failing test.
This event: https://github.com/Onager/plaso/blob/fix_tagging/tests/analysis/tagging.py#L56

Is not matched by this rule: https://github.com/Onager/plaso/blob/fix_tagging/test_data/test_tag_file.txt#L14

When it should be.

[the80srobot]

I think I finally figured out what's wrong and fixed it: https://codereview.appspot.com/302640043/

[the80srobot]

Fixed in 1.5