fix parsing of noncompliant RFC3339 timestamps missing only a timezone (

#3346)
crowdsecurity · Jan 30, 2025 · 5260cf1 · 5260cf1
1 parent 172d6c6
commit 5260cf1
Show file tree

Hide file tree

Showing 2 changed files with 33 additions and 0 deletions.
diff --git a/pkg/parser/enrich_date.go b/pkg/parser/enrich_date.go
@@ -44,6 +44,7 @@ func GenDateParse(date string) (string, time.Time) {
 			"2006-01-02 15:04",
 			"2006/01/02 15:04:05",
 			"2006-01-02 15:04:05",
+			"2006-01-02T15:04:05",
 		}
 	)
 

diff --git a/pkg/parser/enrich_date_test.go b/pkg/parser/enrich_date_test.go
@@ -40,6 +40,38 @@ func TestDateParse(t *testing.T) {
 			},
 			expected: "2011-12-17T08:17:43Z",
 		},
+		{
+			name: "ISO 8601, no timezone",
+			evt: types.Event{
+				StrTime:       "2024-11-26T20:13:32",
+				StrTimeFormat: "",
+			},
+			expected: "2024-11-26T20:13:32Z",
+		},
+		{
+			name: "ISO 8601, no timezone, milliseconds",
+			evt: types.Event{
+				StrTime:       "2024-11-26T20:13:32.123",
+				StrTimeFormat: "",
+			},
+			expected: "2024-11-26T20:13:32.123Z",
+		},
+		{
+			name: "ISO 8601, no timezone, microseconds",
+			evt: types.Event{
+				StrTime:       "2024-11-26T20:13:32.123456",
+				StrTimeFormat: "",
+			},
+			expected: "2024-11-26T20:13:32.123456Z",
+		},
+		{
+			name: "ISO 8601, no timezone, nanoseconds",
+			evt: types.Event{
+				StrTime:       "2024-11-26T20:13:32.123456789",
+				StrTimeFormat: "",
+			},
+			expected: "2024-11-26T20:13:32.123456789Z",
+		},
 	}
 
 	logger := log.WithField("test", "test")