Merge pull request #219 from UncoderIO/gis-9195

nazargesyk · web-flow · commit d1efabf886c4 · 2024-12-17T16:52:13.000+02:00
Gis 9195 fix sentinel one power query regex escaping
diff --git a/uncoder-core/app/translator/platforms/microsoft/renders/microsoft_sentinel_rule.py b/uncoder-core/app/translator/platforms/microsoft/renders/microsoft_sentinel_rule.py
@@ -105,7 +105,7 @@ def finalize_query(
         not_supported_functions: Optional[list] = None,
         unmapped_fields: Optional[list[str]] = None,
         *args,  # noqa: ARG002
-        **kwargs,  # noqa: ARG002
+        **kwargs,
     ) -> str:
         if not kwargs.get("raw_query", False):
             query = super().finalize_query(prefix=prefix, query=query, functions=functions)
diff --git a/uncoder-core/app/translator/platforms/sentinel_one/renders/sentinel_one_power_query.py b/uncoder-core/app/translator/platforms/sentinel_one/renders/sentinel_one_power_query.py
@@ -65,7 +65,7 @@ def contains_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
                 for v in value
             )
             return f"{field} contains ({values})"
-        value = self._pre_process_value(field, value, value_type=ValueType.value)
+        value = self._pre_process_value(field, value, value_type=ValueType.value, wrap_str=True, wrap_int=True)
         return f"{field} contains {value}"
 
     def endswith_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
@@ -77,11 +77,14 @@ def startswith_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
     def regex_modifier(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:
         if isinstance(value, list):
             values = self.list_token.join(
-                self._pre_process_value(field, v, value_type=ValueType.regex_value, wrap_str=True, wrap_int=True)
+                self.str_value_manager.escape_manager.escape(
+                    self._pre_process_value(field, v, value_type=ValueType.regex_value, wrap_str=True, wrap_int=True)
+                )
                 for v in value
             )
             return f"{field} matches ({values})"
         value = self._pre_process_value(field, value, value_type=ValueType.regex_value, wrap_str=True, wrap_int=True)
+        value = self.str_value_manager.escape_manager.escape(value)
         return f"{field} matches {value}"
 
     def is_none(self, field: str, value: DEFAULT_VALUE_TYPE) -> str:  # noqa: ARG002
