Merge pull request #13 from malvidin/line_contains_nul

Clearer Error Handling for Null

Author: gjanders

bin/decrypt.py

@@ -2,6 +2,8 @@
 # coding=utf-8
 
 from __future__ import absolute_import, division, print_function, unicode_literals
+
+import csv
 import os
 import sys
 
@@ -19,23 +21,29 @@ class DecryptCommand(StreamingCommand):
     def stream(self, records):
         stmt = " ".join(self.fieldnames)
 
-        for record in records:
-            try:
-                decryptlib.g_record = record
-                decryptlib.logger = self.logger
-                exception_string = None
-
-                if self.field in record:
-                    result = record[self.field]
-
-                    for fn, args in decryptlib.parsestmt(stmt):
-                        result = fn(result, args)
-
-            except Exception as e:
-                exception_string = str(e)
-                record[".decrypt_failure__"] = exception_string 
-
-            yield record
+        try:
+            for record in records:
+                try:
+                    decryptlib.g_record = record
+                    decryptlib.logger = self.logger
+                    exception_string = None
+
+                    if self.field in record:
+                        result = record[self.field]
+
+                        for fn, args in decryptlib.parsestmt(stmt):
+                            result = fn(result, args)
+
+                except Exception as e:
+                    exception_string = str(e)
+                    record[".decrypt_failure__"] = exception_string
+
+                yield record
+        except csv.Error:
+            raise csv.Error('Splunk record contained NUL. '
+                            'Use eval/replace or rex/sed beforehand to work around, '
+                            'or use the decrypt/escape function in the previous command.'
+                            ' (fixed in Python 3.11)')
 
 
 dispatch(DecryptCommand, sys.argv, sys.stdin, sys.stdout, __name__)