// written by mastiff automatically, please don't edit this file

{
  "pluginId": "osquery",
  "enable": true,
  "type": "pluginConfig",
  "hash": "6c3a3f6a22161912facd77a75d0e6346",
  "config": {
    "rules": [
      {
        "content": "{\n  \"query\": \"SELECT p.pid, p.name, p.cmdline, p.path FROM processes p JOIN process_open_files pf USING(pid) WHERE pf.path = '/dev/tty' AND p.cmdline LIKE '%sh -i';\",\n  \"interval\": 600,\n  \"descirption\": \"通过 fifo 管道实现反弹 shell（间接重定向）\"\n}",
        "ruleId": "reverse_shell_with_fifo_pipe_tty"
      },
      {
        "content": "{\n  \"query\": \"SELECT pid, name, cmdline, path as pipepath FROM (SELECT p.pid, p.name, p.cmdline, pf.path FROM process_open_files pf JOIN processes p USING(pid) WHERE p.name IN ('bash', 'sh')) bf JOIN file USING(path) WHERE type = 'fifo';\",\n  \"interval\": 600,\n  \"descirption\": \"通过 fifo 管道实现反弹 shell（直接重定向）\"\n}",
        "ruleId": "reverse_shell_with_fifo_pipe"
      },
      {
        "content": "{\n    \"query\":\"SELECT p.pid, p.name, p.cmdline, p.path FROM processes p JOIN process_open_sockets s ON p.pid = s.pid WHERE p.pid = (SELECT parent FROM processes WHERE name = 'sh') AND s.state = 'ESTABLISHED' AND p.cmdline LIKE 'python -c exec(%';\",\n    \"interval\":600,\n    \"descirption\":\"通过 socket 实现反弹 shell（Python）\"\n}",
        "ruleId": "reverse_shell_with_socket_python"
      }
    ]
  }
}

func TestJsonParse(t *testing.T) {
	s := "{                                  " +
		"/**                                 " +
		"* environment: dev/test/online      " +
		"*/                                  " +
		"\"env\": \"dev\"                    " +
		"}                                   "
//	fmt.Println(s)
	pure := string(jsonc.ToJSON([]byte(s)))
	fmt.Println(pure)
}

output is

{testonline"env":"dev"}

the correct result should be

{"env":"dev"}

While using the library I encountered an issue, where single line comment can be ended with */. Example:

{
  // I commented a glob pattern like this "**/*"
  "test" : "Hello"
}

The error I got was invalid character '*' looking for beginning of value.

I added a simple check to not try and end the comment with */ if the comment is single line.

C-style comments (// and /* */ are the most popular way to add the annotations to JSON files. Another popular style is shell comments (single-line started with hash #). This style is used in shell scripting languages (bash, zsh, etc.), Python and, Perl.

I noticed that the users use both comment styles, but none Go library supports all of them simultaneously.

This MR adds the possibility to handle the shell comments in your excellent library.

Commented escape characters are leaking into the output JSON, resulting in invalid JSON. For example, if you pass this input JSONC into ToJSON:

{
  "test1": "string with \" escape char"
  //"test2": "string with \" escape char"
}

The output is:

{"test1":"string with \" escape char"\"}

Note the erroneous \" towards the end, which makes this invalid JSON.

1. Update: Better benchmark results for speed and allocations. Replaced append operation with index assignment, reducing allocations. Also used single sate to manage operations.

ToJSON([]byte(`"url": "https://github.com"}`))

expected:

{"url":"https://github.com"}

actual:

{"url":"https:

While working with this library I noticed an issue when loading user-created JSON. The offsets of the errors in JSON is completely broken in case of syntax errors.

Example (from my memory)

Input JSON:

{
  //this is a comment
  "field": "value",
}

In this case, the translation will remove comment and all unneeded whitespace and will result in something like this (not actual output)

{"field":"value",}

When unmarshalling it, it will throw an error about trailing comma (actually about expecting a property, but it's caused by trailing comma) with offset of around 16. When applying this offset to the original JSON, the offset is completely wrong and the user cannot easily find it.

To fix it I left all whitespace in + replaced all comments with spaces in my fork of this library. https://github.com/stirante/jsonc/commit/c4ec34866fdd58b94c38db497febe30286f99e51

I understand that not many people might want this behavior which is why I propose to add it as a separate setting/mode.

Added a small fix, that will ignore quotes inside comments. Previously, this JSON would break:

{
  // This one quote "
  "makes": "everything else broken"
}

Additionally added to tests my previous fix, that was ending single line comments with **/ and current issue with quotes.