MCPcopy
hub / github.com/crowdsecurity/crowdsec / applyDecisionFilter

Function applyDecisionFilter

pkg/database/decisionfilter.go:15–112  ·  view source on GitHub ↗
(query *ent.DecisionQuery, filter map[string][]string)

Source from the content-addressed store, hash-verified

13)
14
15func applyDecisionFilter(query *ent.DecisionQuery, filter map[string][]string) (*ent.DecisionQuery, error) {
16 var (
17 rng csnet.Range
18 err error
19 )
20
21 contains := true
22 /*if contains is true, return bans that *contain* the given value (value is the inner)
23 else, return bans that are *contained* by the given value (value is the outer)*/
24
25 /*the simulated filter is a bit different : if it's not present *or* set to false, specifically exclude records with simulated to true */
26 if v, ok := filter["simulated"]; ok {
27 if v[0] == "false" {
28 query = query.Where(decision.SimulatedEQ(false))
29 }
30
31 delete(filter, "simulated")
32 } else {
33 query = query.Where(decision.SimulatedEQ(false))
34 }
35
36 for param, value := range filter {
37 switch param {
38 case "contains":
39 contains, err = strconv.ParseBool(value[0])
40 if err != nil {
41 return nil, fmt.Errorf("invalid contains value: %w: %w", err, InvalidFilter)
42 }
43 case "scopes", "scope": // Swagger mentions both of them, let's just support both to make sure we don't break anything
44 scopes := strings.Split(value[0], ",")
45 for i, scope := range scopes {
46 switch strings.ToLower(scope) {
47 case "ip":
48 scopes[i] = types.Ip
49 case "range":
50 scopes[i] = types.Range
51 case "country":
52 scopes[i] = types.Country
53 case "as":
54 scopes[i] = types.AS
55 }
56 }
57
58 query = query.Where(decision.ScopeIn(scopes...))
59 case "value":
60 query = query.Where(decision.ValueEQ(value[0]))
61 case "type":
62 query = query.Where(decision.TypeEQ(value[0]))
63 case "origins":
64 query = query.Where(
65 decision.OriginIn(strings.Split(value[0], ",")...),
66 )
67 case "scenarios_containing":
68 predicates := decisionPredicatesFromStr(value[0], decision.ScenarioContainsFold)
69 query = query.Where(decision.Or(predicates...))
70 case "scenarios_not_containing":
71 predicates := decisionPredicatesFromStr(value[0], decision.ScenarioContainsFold)
72 query = query.Where(decision.Not(

Calls 14

SimulatedEQFunction · 0.92
ScopeInFunction · 0.92
ValueEQFunction · 0.92
TypeEQFunction · 0.92
OriginInFunction · 0.92
OrFunction · 0.92
NotFunction · 0.92
NewRangeFunction · 0.92
IDGTFunction · 0.92
decisionIPFilterFunction · 0.85
WhereMethod · 0.45

Tested by

no test coverage detected

Used in the wild real call sites across dependent graphs

searching dependent graphs…