Support reserved word usage in EQL state field, single and collection-valued fields.

Closes #3829
This commit is contained in:
Mark Paluch
2025-04-08 16:29:10 +02:00
parent ee08f8e8a1
commit 4913bbb0ce
3 changed files with 28 additions and 0 deletions

View File

@@ -705,18 +705,22 @@ subtype
collection_valued_field
: identification_variable
| reserved_word
;
single_valued_object_field
: identification_variable
| reserved_word
;
state_field
: identification_variable
| reserved_word
;
collection_value_field
: identification_variable
| reserved_word
;
entity_name

View File

@@ -2317,21 +2317,41 @@ class EqlQueryRenderer extends EqlBaseVisitor<QueryTokenStream> {
@Override
public QueryTokenStream visitCollection_valued_field(EqlParser.Collection_valued_fieldContext ctx) {
if (ctx.reserved_word() != null) {
return visit(ctx.reserved_word());
}
return visit(ctx.identification_variable());
}
@Override
public QueryTokenStream visitSingle_valued_object_field(EqlParser.Single_valued_object_fieldContext ctx) {
if (ctx.reserved_word() != null) {
return visit(ctx.reserved_word());
}
return visit(ctx.identification_variable());
}
@Override
public QueryTokenStream visitState_field(EqlParser.State_fieldContext ctx) {
if (ctx.reserved_word() != null) {
return visit(ctx.reserved_word());
}
return visit(ctx.identification_variable());
}
@Override
public QueryTokenStream visitCollection_value_field(EqlParser.Collection_value_fieldContext ctx) {
if (ctx.reserved_word() != null) {
return visit(ctx.reserved_word());
}
return visit(ctx.identification_variable());
}

View File

@@ -72,6 +72,7 @@ class EqlComplianceTests {
assertQuery("SELECT COUNT(e) FROM Employee e");
assertQuery("SELECT MAX(e.salary) FROM Employee e");
assertQuery("select sum(i.size.foo.bar.new) from Item i");
assertQuery("SELECT NEW com.acme.reports.EmpReport(e.firstName, e.lastName, e.salary) FROM Employee e");
}
@@ -342,8 +343,11 @@ class EqlComplianceTests {
assertQuery("SELECT toDo FROM Employee e JOIN e.toDoList toDo WHERE INDEX(toDo) = 1");
assertQuery("SELECT p FROM Employee e JOIN e.priorities p WHERE KEY(p) = 'high'");
assertQuery("SELECT e FROM Employee e WHERE SIZE(e.managedEmployees) < 2");
assertQuery("SELECT e FROM Employee e WHERE SIZE(e.managedEmployees.new) < 2");
assertQuery("SELECT e FROM Employee e WHERE e.managedEmployees IS EMPTY");
assertQuery("SELECT e FROM Employee e WHERE e.managedEmployee.size.new IS EMPTY");
assertQuery("SELECT e FROM Employee e WHERE 'write code' MEMBER OF e.responsibilities");
assertQuery("SELECT e FROM Employee e WHERE 'write code' MEMBER OF e.responsibilities.size");
assertQuery("SELECT p FROM Project p WHERE TYPE(p) = LargeProject");
/**