fail to parse json file which contains character \"

[jekkay]

// written by mastiff automatically, please don't edit this file

{
  "pluginId": "osquery",
  "enable": true,
  "type": "pluginConfig",
  "hash": "6c3a3f6a22161912facd77a75d0e6346",
  "config": {
    "rules": [
      {
        "content": "{\n  \"query\": \"SELECT p.pid, p.name, p.cmdline, p.path FROM processes p JOIN process_open_files pf USING(pid) WHERE pf.path = '/dev/tty' AND p.cmdline LIKE '%sh -i';\",\n  \"interval\": 600,\n  \"descirption\": \"通过 fifo 管道实现反弹 shell（间接重定向）\"\n}",
        "ruleId": "reverse_shell_with_fifo_pipe_tty"
      },
      {
        "content": "{\n  \"query\": \"SELECT pid, name, cmdline, path as pipepath FROM (SELECT p.pid, p.name, p.cmdline, pf.path FROM process_open_files pf JOIN processes p USING(pid) WHERE p.name IN ('bash', 'sh')) bf JOIN file USING(path) WHERE type = 'fifo';\",\n  \"interval\": 600,\n  \"descirption\": \"通过 fifo 管道实现反弹 shell（直接重定向）\"\n}",
        "ruleId": "reverse_shell_with_fifo_pipe"
      },
      {
        "content": "{\n    \"query\":\"SELECT p.pid, p.name, p.cmdline, p.path FROM processes p JOIN process_open_sockets s ON p.pid = s.pid WHERE p.pid = (SELECT parent FROM processes WHERE name = 'sh') AND s.state = 'ESTABLISHED' AND p.cmdline LIKE 'python -c exec(%';\",\n    \"interval\":600,\n    \"descirption\":\"通过 socket 实现反弹 shell（Python）\"\n}",
        "ruleId": "reverse_shell_with_socket_python"
      }
    ]
  }
}

[jekkay]

我目前的临时方案是用占位符占据特殊字符，转换之后再换回来

// 读取json内容，并且去除注释
func ReadPureJsonFromFile(path string) ([]byte, error) {
	if len(path) <= 0 {
		return nil, errors.New("no local client information file path configured")
	}
	// 此函数有bug，临时方案
	// origin, pure, err := jsonc.ReadFromFile(path)
	// ------ 临时方案 {{ -------
	data, err := ioutil.ReadFile(path)
	if err != nil {
		return nil, err
	}
	// 判定是否含有特殊转义字符
	qus := "\\\""

	var pure []byte
	if strings.Index(string(data), qus) < 0 {
		pure = jsonc.ToJSON(data)
	} else {
		holder := "!临^^时^占^^位^^^符!"
		origin := strings.ReplaceAll(string(data), qus, holder)
		pure = []byte(strings.ReplaceAll(string(jsonc.ToJSON([]byte(origin))), holder, qus))
	}
	// ------ 临时方案 }} ------

	if !json.Valid(pure) {
		// 判断语法是否有效
		return nil, errors.New(fmt.Sprintf("%s is not valid json format", path))
	}
	return pure, nil
}

[muhammadmuzzammil1998]

Kindly use English. Apologies if this sounds rude but I don't know Chinese.

[jekkay]

Kindly use English. Apologies if this sounds rude but I don't know Chinese.

Sorry, i thought u r chinese.

• the first post is the json file content which can not be parsed correctly. the json content contains specail character like \"

• the second post is my temporary ticky solution, replace the \" with special placeholder before translate, and restore the pure json content by replacing placeholder after jsonc.ToJSON(data)

[muhammadmuzzammil1998]

Apologies for replying so late.
I'll look into it now and will try to fix it.

Thanks.

[muhammadmuzzammil1998]

Hello,
I am unable to recreate this error with the current commit (1e787b5). Even in an earlier commit (1265e9b) which fixed the issue #5 it is outputting a valid JSON. Can you please recheck and reopen this issue to let me know if the issue is still there? I have attached the output below.

{
	"pluginId": "osquery",
	"enable": true,
	"type": "pluginConfig",
	"hash": "6c3a3f6a22161912facd77a75d0e6346",
	"config": {
		"rules": [{
				"content": "{\n  \"query\": \"SELECT p.pid, p.name, p.cmdline, p.path FROM processes p JOIN process_open_files pf USING(pid) WHERE pf.path = '/dev/tty' AND p.cmdline LIKE '%sh -i';\",\n  \"interval\": 600,\n  \"descirption\": \"通过 fifo 管道实现反弹 shell（间接重定向）\"\n}",
				"ruleId": "reverse_shell_with_fifo_pipe_tty"
			},
			{
				"content": "{\n  \"query\": \"SELECT pid, name, cmdline, path as pipepath FROM (SELECT p.pid, p.name, p.cmdline, pf.path FROM process_open_files pf JOIN processes p USING(pid) WHERE p.name IN ('bash', 'sh')) bf JOIN file USING(path) WHERE type = 'fifo';\",\n  \"interval\": 600,\n  \"descirption\": \"通过 fifo 管道实现反弹 shell（直接重定向）\"\n}",
				"ruleId": "reverse_shell_with_fifo_pipe"
			},
			{
				"content": "{\n    \"query\":\"SELECT p.pid, p.name, p.cmdline, p.path FROM processes p JOIN process_open_sockets s ON p.pid = s.pid WHERE p.pid = (SELECT parent FROM processes WHERE name = 'sh') AND s.state = 'ESTABLISHED' AND p.cmdline LIKE 'python -c exec(%';\",\n    \"interval\":600,\n    \"descirption\":\"通过 socket 实现反弹 shell（Python）\"\n}",
				"ruleId": "reverse_shell_with_socket_python"
			}
		]
	}
}

Thanks!