Skip to content

feat: support custom regex for rule id lookup#628

Open
blinxen wants to merge 9 commits intocoreruleset:mainfrom
blinxen:main
Open

feat: support custom regex for rule id lookup#628
blinxen wants to merge 9 commits intocoreruleset:mainfrom
blinxen:main

Conversation

@blinxen
Copy link
Copy Markdown

@blinxen blinxen commented Apr 20, 2026

I have the same issue with #614 and created this PR in response :D. The PR adds both regexes used for rule id lookup into the global configuration.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds configurability for the regexes used to extract WAF rule IDs from log lines, addressing the limitation described in #614.

Changes:

  • Introduces default regex constants and new config fields for standard and JSON log rule-id extraction.
  • Stores compiled regexes on FTWLogLines and updates log parsing to use those instance regexes.
  • Adds/updates tests to validate default regex initialization and a custom regex override path.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 6 comments.

Show a summary per file
File Description
config/types.go Adds default regex constants and exposes regex fields on global config.
config/config.go Sets default values for the new config fields.
config/runner_config.go Propagates the new config fields into RunnerConfig.
waflog/types.go Adds regex fields to FTWLogLines and initializes them during reset.
waflog/waflog.go Compiles regexes from runner config into FTWLogLines and adds a setter.
waflog/read.go Switches rule-id parsing from package-level regexes to instance regex fields.
waflog/read_test.go Adds a test for custom std-log rule-id regex behavior.
waflog/waflog_test.go Extends reset test to assert regex initialization.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread config/types.go Outdated
Comment thread waflog/types.go Outdated
Comment thread waflog/waflog.go
Comment thread waflog/waflog.go Outdated
Comment thread waflog/waflog_test.go Outdated
Comment thread config/types.go Outdated
blinxen and others added 5 commits April 20, 2026 23:23
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@fzipi
Copy link
Copy Markdown
Member

fzipi commented Apr 20, 2026

Please close conversations as you address the review 😄

@blinxen
Copy link
Copy Markdown
Author

blinxen commented Apr 21, 2026

I am pretty new to AI reviews. I thought the AI would trigger a re-review after all conversations are closed, I guess that was wrong.

Should I open them again and comment on the reviews?

Thanks for reviewing this PR!

@fzipi
Copy link
Copy Markdown
Member

fzipi commented Apr 21, 2026

No worries, I've triggered a new review.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread waflog/waflog.go Outdated
Comment thread waflog/read.go
Comment thread waflog/waflog.go
ll.stdLogIdRegex = compiledRegex
return nil
}

Copy link

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WithStdLogIdRegex introduces a public override hook for only the std log regex, but there’s no equivalent for the JSON log regex. Either add a matching WithJsonLogIdRegex (and consider a combined setter), or keep these overrides internal to tests via config to avoid an asymmetric public API.

Suggested change
func (ll *FTWLogLines) WithJsonLogIdRegex(regex string) error {
compiledRegex, err := regexp.Compile(regex)
if err != nil {
return err
}
ll.jsonLogIdRegex = compiledRegex
return nil
}

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Copilot

What do you mean with

keep these overrides internal to tests via config

Comment thread waflog/read_test.go Outdated
s.Require().NoError(err)
ll.WithStartMarker(bytes.ToLower([]byte(startMarkerLine)))
ll.WithEndMarker(bytes.ToLower([]byte(endMarkerLine)))
err = ll.WithStdLogIdRegex(`\[id="(\d+)"\]`)
Copy link

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This line is indented with spaces and doesn’t match gofmt formatting used throughout the file; running gofmt will fix it and avoid style/tooling failures in CI/pre-commit hooks.

Suggested change
err = ll.WithStdLogIdRegex(`\[id="(\d+)"\]`)
err = ll.WithStdLogIdRegex(`\[id="(\d+)"\]`)

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Copilot This seems to be an issue with .editorconfig. I changed it in my latest commit.

blinxen and others added 3 commits April 23, 2026 23:04
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@blinxen
Copy link
Copy Markdown
Author

blinxen commented Apr 26, 2026

Please close conversations as you address the review 😄

It does not looks like the AI does anything if I comment on the review or address the AI directly. Do I have to address and then close the conversation?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants