From: Jason Ish <jason.ish@oisf.net>
Date: Wed, 3 Jan 2024 20:33:26 +0000 (-0600)
Subject: check-eve: test for duplicate json keys
X-Git-Tag: suricata-6.0.16~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=952bb7b63a03925584376256c3b7bc3026c94a0c;p=thirdparty%2Fsuricata-verify.git

check-eve: test for duplicate json keys

Add a duplicate key check to check-eve. If a duplicate key is found
in a JSON record, the test will fail with a schema error.
---

diff --git a/check-eve.py b/check-eve.py
index a21b7060d..1aaadccdf 100755
--- a/check-eve.py
+++ b/check-eve.py
@@ -36,6 +36,28 @@ try:
 except:
     HAVE_PY = False
 
+
+class DuplicateKeyError(Exception):
+    pass
+
+
+def duplicate_key_object_pair_hook(pairs):
+    d = {}
+    for k, v in pairs:
+        if k in d:
+            raise DuplicateKeyError(
+                "key={}, current value={}, new value={}".format(k, d[k], v)
+            )
+        d[k] = v
+    return d
+
+
+def check_duplicate_keys(filename):
+    with open(filename) as json_in:
+        for line in json_in:
+            json.loads(line, object_pairs_hook=duplicate_key_object_pair_hook)
+
+
 def validate_json(args, json_filename, schema):
     status = "OK"
     errors = []
@@ -56,6 +78,14 @@ def validate_json(args, json_filename, schema):
                     status = "FAIL"
                     errors.append(err.message)
 
+    # Look for duplicate keys.
+    try:
+        check_duplicate_keys(json_filename)
+    except DuplicateKeyError as err:
+        print("{}: duplicate key error: {}".format(json_filename, err))
+        status = "FAIL"
+        errors.append(err)
+
     if not args.quiet:
         if status == "FAIL":
             print("===> %s: FAIL " % json_filename)