From 80eb9be78d27fdd6f1132053083f4c491a71e731 Mon Sep 17 00:00:00 2001
From: Ashutosh Narkar <anarkar4387@gmail.com>
Date: Wed, 8 Jun 2022 22:27:00 -0700
Subject: [PATCH] plugins/logs: Update mechanism to escape field paths (#4756)

Earlier the paths to the field to perform an upsert or
remove operation on were escaped using Go's url.QueryEscape
method. This results in incorrect behavior when the paths contain
a reserved character like ":". This change updates to using
url.PathEscape instead to escape the input and result paths.

Fixes: #4717

Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
---
 plugins/logs/mask.go      |  4 ++--
 plugins/logs/mask_test.go | 19 +++++++++++++++++++
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/plugins/logs/mask.go b/plugins/logs/mask.go
index 765500c35d..1355207e2f 100644
--- a/plugins/logs/mask.go
+++ b/plugins/logs/mask.go
@@ -70,12 +70,12 @@ func newMaskRule(path string, opts ...maskRuleOption) (*maskRule, error) {
 
 	escapedParts := make([]string, len(parts))
 	for i := range parts {
-		_, err := url.QueryUnescape(parts[i])
+		_, err := url.PathUnescape(parts[i])
 		if err != nil {
 			return nil, err
 		}
 
-		escapedParts[i] = url.QueryEscape(parts[i])
+		escapedParts[i] = url.PathEscape(parts[i])
 	}
 
 	modifyFullObj := false
diff --git a/plugins/logs/mask_test.go b/plugins/logs/mask_test.go
index de371fc0a3..02b24ad780 100644
--- a/plugins/logs/mask_test.go
+++ b/plugins/logs/mask_test.go
@@ -541,6 +541,25 @@ func TestMaskRuleMask(t *testing.T) {
 			event: `{"input": {"foo": [{"bar": 1, "baz": 2}]}}`,
 			exp:   `{"input": {"foo": [{"baz": 2}]}, "erased": ["/input/foo/0/bar"]}`,
 		},
+		{
+			note: "erase input: special character in path",
+			ptr: &maskRule{
+				OP:   maskOPRemove,
+				Path: "/input/:path",
+			},
+			event: `{"input": {"bar": 1, ":path": "token"}}`,
+			exp:   `{"input": {"bar": 1}, "erased": ["/input/:path"]}`,
+		},
+		{
+			note: "upsert input: special character in path",
+			ptr: &maskRule{
+				OP:    maskOPUpsert,
+				Path:  "/input/:path",
+				Value: "upserted",
+			},
+			event: `{"input": {"bar": 1, ":path": "token"}}`,
+			exp:   `{"input": {"bar": 1, ":path": "upserted"}, "masked": ["/input/:path"]}`,
+		},
 	}
 
 	for _, tc := range tests {