howler-api 3.2.0.dev558__tar.gz → 3.2.0.dev561__tar.gz

{howler_api-3.2.0.dev558 → howler_api-3.2.0.dev561}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 3.2.0.dev558
+Version: 3.2.0.dev561
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-3.2.0.dev558 → howler_api-3.2.0.dev561}/howler/services/lucene_service.py

@@ -148,6 +148,11 @@ class LuceneProcessor(TreeVisitor):
         # Unescape escaped colons in value
         sanitized_value = sanitized_value.replace("\\:", ":")
 
+        # Unescape Lucene-escaped spaces so fnmatch can match them correctly
+        # (fnmatch does not treat \ as an escape character, so *\ foo\ * would require
+        # a literal backslash in the candidate rather than matching a space)
+        sanitized_value = sanitized_value.replace("\\ ", " ")
+
         return sanitized_value
 
     @staticmethod

{howler_api-3.2.0.dev558 → howler_api-3.2.0.dev561}/howler/utils/lucene.py

@@ -69,9 +69,18 @@ def normalize_phrase(value: str, type: Union[Literal["phrase"], Literal["word"]]
         # probably an ID, no normalization
         return [value, value.lower()]
 
+    candidates: list[str] = []
     if type == "word":
-        value = re.sub(r"[^a-z0-9.,@_:/;()\-]", "", value.lower())
+        candidates.append(re.sub(r"[^a-z0-9.,@_:/;()\-]", "", value.lower()))
+        candidates.append(re.sub(r"[^A-Za-z0-9.,@_:/;()\-]", "", value))
+        # For values that contain spaces (e.g. process.command_line), also include a
+        # space-preserved candidate so that wildcard patterns with escaped spaces can match.
+        if " " in value:
+            candidates.append(re.sub(r"[^a-z0-9.,@_:/;()\- ]", "", value.lower()))
+            candidates.append(re.sub(r"[^A-Za-z0-9.,@_:/;()\- ]", "", value))
+
+        return candidates
     else:
-        value = re.sub(r"[^a-z0-9.,@_:/;()\- ]", "", value, flags=re.IGNORECASE)
+        candidates.append(re.sub(r"[^a-z0-9.,@_:/;()\- ]", "", value, flags=re.IGNORECASE))
 
-    return [value]
+    return candidates

{howler_api-3.2.0.dev558 → howler_api-3.2.0.dev561}/pyproject.toml

@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "3.2.0.dev558"
+version = "3.2.0.dev561"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",