zeek / broker

Zeek's Messaging Library

Home Page:https://docs.zeek.org/projects/broker

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Websocket API: holes in vectors not preseved

simeonmiteff opened this issue · comments

If we create a hole in a zeek vector as follows:

local v: vector of string = vector();
v[0] = "one";
# hole at v[1]
v[2] = "three";

...and send that in an event via broker, a subscriber on the websocket API sees the (JSON encoded equivalent of): ["one", "three"], i.e., the hole is consumed.

I thought maybe this is the purpose of the none type, so I did an experiment where I sent (JSON encoded equivalent of) ["one", {}, "three"] from a websocket client, but nothing happens (as in: the event is not received in the zeek script, nor do I receive an error via the websocket, nor is anything written to reporter.log). Would that also be a (separate) bug?

Sorry for the delay here, there's been a lot going on recently.

I thought maybe this is the purpose of the none type

Yes, I'd expect ["one", none, "three"] as well for that snippet. Let me try to reproduce it and see whether it's Zeek mapping this incorrectly or a bug in Broker.

Would that also be a (separate) bug?

I'll take a look.

Can you provide me with more details on the JSON encoding you've used? I've expanded our btest suite for WebSocket (d80742d#diff-8041d0076377a29bf0fa60d24347679420b9fc80ad54758f2f16e288e9153443R27) and it seems to work fine.

Closing here since it turns out to be a Zeek-related behavior. I couldn't reproduce the issue with JSON, but please go ahead an open a new issue if I've overlooked something. :)