Function EvalAlertContextRules

pkg/alertcontext/alertcontext.go:159–226

(evt pipeline.Event, match *pipeline.MatchedRule, request *http.Request, tmpContext map[string][]string)

}

func EvalAlertContextRules(evt pipeline.Event, match *pipeline.MatchedRule, request *http.Request, tmpContext map[string][]string) []error {
	var errors []error

	// if we're evaluating context for appsec event, match and request will be present.
	// otherwise, only evt will be.
	if match == nil {
		match = pipeline.NewMatchedRule()
	}

	if request == nil {
		request = &http.Request{}
	}

	ac := getAlertContext()

	for key, values := range ac.ContextToSendCompiled {
		if _, ok := tmpContext[key]; !ok {
			tmpContext[key] = make([]string, 0)
		}

		for _, value := range values {
			var val string

			output, err := expr.Run(value, map[string]any{"match": match, "evt": evt, "req": request})
			if err != nil {
				errors = append(errors, fmt.Errorf("failed to get value for %s: %w", key, err))
				continue
			}

			switch out := output.(type) {
			case string:
				val = out
				if val != "" && !slices.Contains(tmpContext[key], val) {
					tmpContext[key] = append(tmpContext[key], val)
				}
			case []string:
				for _, v := range out {
					if v != "" && !slices.Contains(tmpContext[key], v) {
						tmpContext[key] = append(tmpContext[key], v)
					}
				}
			case int:
				val = strconv.Itoa(out)
				if val != "" && !slices.Contains(tmpContext[key], val) {
					tmpContext[key] = append(tmpContext[key], val)
				}
			case []int:
				for _, v := range out {
					val = strconv.Itoa(v)
					if val != "" && !slices.Contains(tmpContext[key], val) {
						tmpContext[key] = append(tmpContext[key], val)
					}
				}
			default:
				r := reflect.ValueOf(output)
				if r.IsZero() || r.IsNil() {
					continue
				}