Skip to content

fix(fingerprinthub): preserve original body case for DSL/regex matchers#14

Open
wuchulonly wants to merge 1 commit into
chainreactors:masterfrom
wuchulonly:fix/webmatch-preserve-body-case
Open

fix(fingerprinthub): preserve original body case for DSL/regex matchers#14
wuchulonly wants to merge 1 commit into
chainreactors:masterfrom
wuchulonly:fix/webmatch-preserve-body-case

Conversation

@wuchulonly
Copy link
Copy Markdown

Problem

WebMatch lowercases the entire HTTP body before passing it to the InternalEvent used by matchers. This breaks DSL matchers and regex matchers that use case-sensitive patterns.

For example, a template with:

matchers:
- type: dsl
  dsl:
  - 'contains(body, "<title>Nacos") && contains(body, "console-ui/public/js/xml.js")'

...will never match because the body in the event is already lowercased to <title>nacos.

This affects all fingerprinthub templates using DSL contains() with mixed-case literals, or regex patterns with case-sensitive anchors.

Root Cause

Line 381 in fingerprinthub.go:

body := bytes.ToLower(httputils.ReadBody(resp))

The lowercased body is then passed to buildInternalEvent, which sets event["body"] = bodyStr. When matchRequest calls req.Match(event, matcher), DSL expressions evaluate contains(body, ...) against the already-lowercased body.

Word matchers are unaffected because MatchWords already lowercases both the corpus and keywords internally (matcher.go:144, 185).

Fix

  • Keep the lowercased body only for the AC keyword index prefiltering (webTemplateIndex.Match)
  • Pass the original-case body to buildInternalEvent so DSL/regex matchers see the real content

Testing

  • Added TestWebMatch_DSLCaseSensitivity — constructs a DSL template with mixed-case literals and verifies it matches
  • Existing TestWebMatchConsistency_Static and TestTemplateKeywordIndex_* tests pass unchanged

WebMatch was lowercasing the entire body before passing it to the
InternalEvent, which broke case-sensitive DSL expressions like
contains(body, "<title>Nacos"). Word matchers already handle
case-insensitivity internally (MatchWords lowercases both corpus
and keywords), so the ToLower at the WebMatch level was redundant
for them but destructive for DSL and regex matchers.

Now the AC keyword index receives the lowercased body for prefiltering,
while the InternalEvent (used by matchRequest → DSL/regex evaluation)
receives the original-case body.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant