Commit 3b749590 authored by olivier R-D's avatar olivier R-D

fix typo in WhereClauseEvaluator

parent 94a2bb42
...@@ -415,21 +415,23 @@ class WhereClauseEvaluator(object): ...@@ -415,21 +415,23 @@ class WhereClauseEvaluator(object):
elif el.FilterOperator == ua.FilterOperator.Or: elif el.FilterOperator == ua.FilterOperator.Or:
return self._eval_op(ops[0], event) or self._eval_el(ops[1], event) return self._eval_op(ops[0], event) or self._eval_el(ops[1], event)
elif el.FilterOperator == ua.FilterOperator.Cast: elif el.FilterOperator == ua.FilterOperator.Cast:
self.logger("Cast operand not implemented") self.logger.warn("Cast operand not implemented, assuming True")
raise NotImplementError return True
elif el.FilterOperator == ua.FilterOperator.OfType:
self.logger.warn("OfType operand not implemented, assuming True")
return True
else: else:
# TODO: implement missing operators # TODO: implement missing operators
print("WhereClause not implemented for element: %s", el) print("WhereClause not implemented for element: %s", el)
raise NotImplementError raise NotImplementedError
def _like_operator(self, string, pattern): def _like_operator(self, string, pattern):
raise NotImplementError raise NotImplementedError
def _eval_op(self, op, event): def _eval_op(self, op, event):
# seems spec says we should return Null if issues # seems spec says we should return Null if issues
if type(op) is ua.ElementOperand: if type(op) is ua.ElementOperand:
el = self.elements[op.FilterOperands[0].Index] return self._eval_el(op.Index, event)
return self._eval_el(el)
elif type(op) is ua.AttributeOperand: elif type(op) is ua.AttributeOperand:
if op.BrowsePath: if op.BrowsePath:
return getattr(event, op.BrowsePath.Elements[0].TargetName.Name) return getattr(event, op.BrowsePath.Elements[0].TargetName.Name)
...@@ -446,8 +448,8 @@ class WhereClauseEvaluator(object): ...@@ -446,8 +448,8 @@ class WhereClauseEvaluator(object):
elif type(op) is ua.LiteralOperand: elif type(op) is ua.LiteralOperand:
return op.Value.Value return op.Value.Value
else: else:
self.logger.warning("Where clause element % is not of a known type", el) self.logger.warning("Where clause element % is not of a known type", op)
raise NotImplementError raise NotImplementedError
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment