spl2-testing-framework 1.7.1__tar.gz → 1.7.2__tar.gz

{spl2_testing_framework-1.7.1 → spl2_testing_framework-1.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: spl2-testing-framework
-Version: 1.7.1
+Version: 1.7.2
 Summary: SPL2 Testing Framework
 Home-page: https://github.com/splunk/spl2-testing-framework
 Keywords: SPL2 testing framework

{spl2_testing_framework-1.7.1 → spl2_testing_framework-1.7.2}/pyproject.toml

@@ -15,7 +15,7 @@
 
 [tool.poetry]
 name = "spl2-testing-framework"
-version = "1.7.1"
+version = "1.7.2"
 description = "SPL2 Testing Framework"
 authors = ["mgazda-splunk <mgazda@splunk.com>"]
 readme = "README.md"

{spl2_testing_framework-1.7.1 → spl2_testing_framework-1.7.2}/spl2_testing_framework/tools/utils.py

@@ -95,19 +95,32 @@ def validate_compatibility(actual, expected):
     assert not_extracted == {}
 
 
+_QUOTED_STRING_OR_BARE_KEY = re.compile(
+    r'"(?:[^"\\]|\\.)*"' r"|" r"([{,])\s*([A-Za-z_]+)\s*(:)"
+)
+
+
+def _quote_unquoted_keys(input_str):
+    """Wrap bare (unquoted) object keys in double quotes to produce valid JSON,
+    without corrupting content inside JSON string values.
+
+    Uses regex alternation: the first branch consumes quoted strings (so their
+    content is never touched), the second branch captures bare keys to quote.
+    """
+
+    def _replacer(m):
+        if m.group(1) is None:
+            return m.group(0)
+        return f'{m.group(1)}"{m.group(2)}":'
+
+    return _QUOTED_STRING_OR_BARE_KEY.sub(_replacer, input_str)
+
+
 def parse_raw_from_input(input_str):
     """Parse SPL2-style or JSON array of events and return list of _raw field values.
     Handles unquoted keys (e.g. {_raw: "x"}) by converting them to JSON-quoted keys.
     """
-    # Only replace unquoted keys: key must be preceded by { or , (and optional space)
-    key_pattern = re.compile(
-        r"(\{|,)\s*(_raw|source|sourcetype|host)\s*:", re.MULTILINE
-    )
-
-    def quote_key(match):
-        return f'{match.group(1)}"{match.group(2)}":'
-
-    normalized = key_pattern.sub(quote_key, input_str)
+    normalized = _quote_unquoted_keys(input_str)
     try:
         parsed = json.loads(normalized)
     except json.JSONDecodeError: