Skip Menu |

This queue is for tickets about the RT-Extension-ExtractCustomFieldValues CPAN distribution.

Report information
The Basics
Id: 69582
Status: resolved
Priority: 0/
Queue: RT-Extension-ExtractCustomFieldValues
People
Owner: Nobody in particular
Requestors: kurt [...] cyberanderson.com
Cc:
AdminCc:
Bug Information
Severity: Important
Broken in: (no value)
Fixed in: (no value)

History Show all quoted text
  Tue Jul 19 13:19:57 2011 kurt [...] cyberanderson.com - Ticket created
Subject: Char limit in |Matchstring(re)|
There appears to be a char limit in the Matchstring. char length 18? This works when proper field in email body <body> Correlation Messag=UHT-Attack_Access_Modification_HostBased_Overflow-IPS <end body> env_CorrMessageID|Body|Correlation Messag=(.+)?||q This does not work when proper field in email body <body> Correlation Message=UHT-Attack_Access_Modification_HostBased_Overflow-IPS <end body> env_CorrMessageID|Body|Correlation Message=(.+)?||q RT 3.8.1 This is perl, v5.8.8 built for i386-linux-thread-multi Linux xxxxx.xxx.xxx 2.6.18-92.1.10.el5 #1 SMP Tue Aug 5 07:41:53 EDT 2008 i686 i686 i386 GNU/Linux this is rt.log (debug on) when Matchstring 18 chars or less: [Tue Jul 19 14:21:30 2011] [debug]: Looking to extract: CFName=env_CorrMessageID Field=Body Match=Correlation Messag=(.+)? Options=q PostEdit= (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:60) [Tue Jul 19 14:21:30 2011] [debug]: Looking for CF env_CorrMessageID (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:109) [Tue Jul 19 14:21:30 2011] [debug]: Found CF id 27 (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:124) [Tue Jul 19 14:21:30 2011] [debug]: Looking at attachment 1, content-type multipart/mixed (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143) [Tue Jul 19 14:21:30 2011] [debug]: Looking at attachment 2, content-type text/plain (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143) [Tue Jul 19 14:21:30 2011] [debug]: Examining content of body (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:154) [Tue Jul 19 14:21:30 2011] [debug]: Found value for CF: UHT-Attack_Access_Modification_HostBased_Overflow-IPS (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:193) [Tue Jul 19 14:21:30 2011] [info]: CustomFieldValue (env_CorrMessageID,UHT-Attack_Access_Modification_HostBased_Overflow-IPS) added: 31666 env_CorrMessageID UHT-Attack_Access_Modification_HostBased_Overflow-IPS added (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:199) [Tue Jul 19 14:21:30 2011] [debug]: Looking at attachment 3, content-type image/gz (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143) this is rt.log (debug on) when Matchstring more then 18 chars: [Tue Jul 19 14:24:15 2011] [debug]: Looking to extract: CFName=env_CorrMessageID Field=Body Match=Correlation Message=(.+)? Options=q PostEdit= (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:60) [Tue Jul 19 14:24:15 2011] [debug]: Looking for CF env_CorrMessageID (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:109) [Tue Jul 19 14:24:15 2011] [debug]: Found CF id 27 (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:124) [Tue Jul 19 14:24:15 2011] [debug]: Looking at attachment 1, content-type multipart/mixed (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143) [Tue Jul 19 14:24:15 2011] [debug]: Looking at attachment 2, content-type text/plain (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143) [Tue Jul 19 14:24:15 2011] [debug]: Examining content of body (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:154) [Tue Jul 19 14:24:15 2011] [debug]: Looking at attachment 3, content-type image/gz (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143) [Tue Jul 19 14:24:15 2011] [debug]: Committing scrip #3 on txn #76512 of ticket #3322 (/opt/rt3/bin/../lib/RT/Scrips_Overlay.pm:190)
  Tue Jul 19 13:39:32 2011 kevin [...] jibsheet.com - Correspondence added
Subject: Re: [rt.cpan.org #69582] Char limit in |Matchstring(re)|
Date: Tue, 19 Jul 2011 13:39:06 -0400
To: Kurt via RT <bug-RT-Extension-ExtractCustomFieldValues [...] rt.cpan.org>
From: Kevin Falcone <kevin [...] jibsheet.com>
On Tue, Jul 19, 2011 at 01:19:58PM -0400, Kurt via RT wrote: Show quoted text
> There appears to be a char limit in the Matchstring. char length 18?
There is not a hardcoded match limit in this extension. Show quoted text
> This works when proper field in email body > <body> > Correlation Messag=UHT-Attack_Access_Modification_HostBased_Overflow-IPS > <end body> > > env_CorrMessageID|Body|Correlation Messag=(.+)?||q > > This does not work when proper field in email body > <body> > Correlation Message=UHT-Attack_Access_Modification_HostBased_Overflow-IPS > <end body> > > env_CorrMessageID|Body|Correlation Message=(.+)?||q > > RT 3.8.1 > This is perl, v5.8.8 built for i386-linux-thread-multi > Linux xxxxx.xxx.xxx 2.6.18-92.1.10.el5 #1 SMP Tue Aug 5 07:41:53 EDT > 2008 i686 i686 i386 GNU/Linux
You didn't include your ExtractCustomFieldValues version, however on 3.8.10 and 3.07 of ECFV I cannot replicate your failure using your template and your Since your working line is 72 characters and your failing example is 73 I assume there is some wrapping happening. You can view the raw source of the mail that RT receives by clicking on the Download Attachment link in the ticket history. -kevin Show quoted text
> > this is rt.log (debug on) when Matchstring 18 chars or less: > > [Tue Jul 19 14:21:30 2011] [debug]: Looking to extract: > CFName=env_CorrMessageID Field=Body Match=Correlation Messag=(.+)? > Options=q PostEdit= > (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:60) > [Tue Jul 19 14:21:30 2011] [debug]: Looking for CF env_CorrMessageID > (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:109) > [Tue Jul 19 14:21:30 2011] [debug]: Found CF id 27 > (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:124) > [Tue Jul 19 14:21:30 2011] [debug]: Looking at attachment 1, > content-type multipart/mixed > (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143) > [Tue Jul 19 14:21:30 2011] [debug]: Looking at attachment 2, > content-type text/plain > (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143) > [Tue Jul 19 14:21:30 2011] [debug]: Examining content of body > (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:154) > [Tue Jul 19 14:21:30 2011] [debug]: Found value for CF: > UHT-Attack_Access_Modification_HostBased_Overflow-IPS > (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:193) > [Tue Jul 19 14:21:30 2011] [info]: CustomFieldValue > (env_CorrMessageID,UHT-Attack_Access_Modification_HostBased_Overflow-IPS) added: > 31666 env_CorrMessageID > UHT-Attack_Access_Modification_HostBased_Overflow-IPS added > (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:199) > [Tue Jul 19 14:21:30 2011] [debug]: Looking at attachment 3, > content-type image/gz > (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143) > > > this is rt.log (debug on) when Matchstring more then 18 chars: > > [Tue Jul 19 14:24:15 2011] [debug]: Looking to extract: > CFName=env_CorrMessageID Field=Body Match=Correlation Message=(.+)? > Options=q PostEdit= > (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:60) > [Tue Jul 19 14:24:15 2011] [debug]: Looking for CF env_CorrMessageID > (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:109) > [Tue Jul 19 14:24:15 2011] [debug]: Found CF id 27 > (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:124) > [Tue Jul 19 14:24:15 2011] [debug]: Looking at attachment 1, > content-type multipart/mixed > (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143) > [Tue Jul 19 14:24:15 2011] [debug]: Looking at attachment 2, > content-type text/plain > (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143) > [Tue Jul 19 14:24:15 2011] [debug]: Examining content of body > (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:154) > [Tue Jul 19 14:24:15 2011] [debug]: Looking at attachment 3, > content-type image/gz > (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143) > [Tue Jul 19 14:24:15 2011] [debug]: Committing scrip #3 on txn #76512 of > ticket #3322 (/opt/rt3/bin/../lib/RT/Scrips_Overlay.pm:190)
  Tue Jul 19 13:39:36 2011 The RT System itself - Status changed from 'new' to 'open'
  Tue Jul 19 13:40:10 2011 cpan [...] jibsheet.com - Status changed from 'open' to 'stalled'
  Tue Jul 19 13:48:04 2011 kurt [...] cyberanderson.com - Correspondence added
Subject: Re: [rt.cpan.org #69582] Char limit in |Matchstring(re)|
Date: Tue, 19 Jul 2011 12:47:48 -0500
To: bug-RT-Extension-ExtractCustomFieldValues [...] rt.cpan.org
From: Kurt Anderson <kurt [...] cyberanderson.com>
It is wrapping. I didn't think to check the raw email in History Thanks, Kurt On Tue, Jul 19, 2011 at 12:39 PM, Kevin Falcone via RT < bug-RT-Extension-ExtractCustomFieldValues@rt.cpan.org> wrote: Show quoted text
> <URL: https://rt.cpan.org/Ticket/Display.html?id=69582 > > > On Tue, Jul 19, 2011 at 01:19:58PM -0400, Kurt via RT wrote:
> > There appears to be a char limit in the Matchstring. char length 18?
> > There is not a hardcoded match limit in this extension. >
> > This works when proper field in email body > > <body> > > Correlation Messag=UHT-Attack_Access_Modification_HostBased_Overflow-IPS > > <end body> > > > > env_CorrMessageID|Body|Correlation Messag=(.+)?||q > > > > This does not work when proper field in email body > > <body> > > Correlation Message=UHT-Attack_Access_Modification_HostBased_Overflow-IPS > > <end body> > > > > env_CorrMessageID|Body|Correlation Message=(.+)?||q > > > > RT 3.8.1 > > This is perl, v5.8.8 built for i386-linux-thread-multi > > Linux xxxxx.xxx.xxx 2.6.18-92.1.10.el5 #1 SMP Tue Aug 5 07:41:53 EDT > > 2008 i686 i686 i386 GNU/Linux
> > You didn't include your ExtractCustomFieldValues version, however on > 3.8.10 and 3.07 of ECFV I cannot replicate your failure using your > template and your > > Since your working line is 72 characters and your failing example > is 73 I assume there is some wrapping happening. You can view the raw > source of the mail that RT receives by clicking on the Download > Attachment link in the ticket history. > > -kevin >
> > > > this is rt.log (debug on) when Matchstring 18 chars or less: > > > > [Tue Jul 19 14:21:30 2011] [debug]: Looking to extract: > > CFName=env_CorrMessageID Field=Body Match=Correlation Messag=(.+)? > > Options=q PostEdit= > >
> (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:60)
> > [Tue Jul 19 14:21:30 2011] [debug]: Looking for CF env_CorrMessageID > >
> (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:109)
> > [Tue Jul 19 14:21:30 2011] [debug]: Found CF id 27 > >
> (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:124)
> > [Tue Jul 19 14:21:30 2011] [debug]: Looking at attachment 1, > > content-type multipart/mixed > >
> (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143)
> > [Tue Jul 19 14:21:30 2011] [debug]: Looking at attachment 2, > > content-type text/plain > >
> (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143)
> > [Tue Jul 19 14:21:30 2011] [debug]: Examining content of body > >
> (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:154)
> > [Tue Jul 19 14:21:30 2011] [debug]: Found value for CF: > > UHT-Attack_Access_Modification_HostBased_Overflow-IPS > >
> (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:193)
> > [Tue Jul 19 14:21:30 2011] [info]: CustomFieldValue > > (env_CorrMessageID,UHT-Attack_Access_Modification_HostBased_Overflow-IPS)
> added:
> > 31666 env_CorrMessageID > > UHT-Attack_Access_Modification_HostBased_Overflow-IPS added > >
> (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:199)
> > [Tue Jul 19 14:21:30 2011] [debug]: Looking at attachment 3, > > content-type image/gz > >
> (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143)
> > > > > > this is rt.log (debug on) when Matchstring more then 18 chars: > > > > [Tue Jul 19 14:24:15 2011] [debug]: Looking to extract: > > CFName=env_CorrMessageID Field=Body Match=Correlation Message=(.+)? > > Options=q PostEdit= > >
> (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:60)
> > [Tue Jul 19 14:24:15 2011] [debug]: Looking for CF env_CorrMessageID > >
> (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:109)
> > [Tue Jul 19 14:24:15 2011] [debug]: Found CF id 27 > >
> (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:124)
> > [Tue Jul 19 14:24:15 2011] [debug]: Looking at attachment 1, > > content-type multipart/mixed > >
> (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143)
> > [Tue Jul 19 14:24:15 2011] [debug]: Looking at attachment 2, > > content-type text/plain > >
> (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143)
> > [Tue Jul 19 14:24:15 2011] [debug]: Examining content of body > >
> (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:154)
> > [Tue Jul 19 14:24:15 2011] [debug]: Looking at attachment 3, > > content-type image/gz > >
> (/opt/rt3/local/plugins/RT-Extension-ExtractCustomFieldValues/lib/RT/Action/ExtractCustomFieldValues.pm:143)
> > [Tue Jul 19 14:24:15 2011] [debug]: Committing scrip #3 on txn #76512 of > > ticket #3322 (/opt/rt3/bin/../lib/RT/Scrips_Overlay.pm:190)
> >
  Tue Jul 19 13:48:05 2011 The RT System itself - Status changed from 'stalled' to 'open'
  Tue Jul 19 13:49:38 2011 cpan [...] chmrr.net - Status changed from 'open' to 'resolved'