fix: (dpluger) add aggregation key type checking

internal/pkg/dpluger/es5client.go

@@ -94,7 +94,10 @@ func (es *es5Client) CollectPair(plugin Plugin, confFile, sidSource, esFilter, t
 		}
 		for _, lvl2Bucket := range subterm.Buckets {
 			sKey := lvl1Bucket.Key.(string)
-			nKey := int(lvl2Bucket.Key.(float64))
+			nKey, err := toInt(lvl2Bucket.Key)
+			if err != nil {
+				return c, fmt.Errorf("invalid sid aggregation key, %s", err.Error())
+			}
 			// fmt.Println("item1:", sKey, "item2:", nKey)
 			if shouldCollectCategory {
 				subSubTerm, found2 := lvl1Bucket.Terms("subSubTerm")

internal/pkg/dpluger/es6client.go

@@ -95,7 +95,10 @@ func (es *es6Client) CollectPair(plugin Plugin, confFile, sidSource, esFilter, t
 		}
 		for _, lvl2Bucket := range subterm.Buckets {
 			sKey := lvl1Bucket.Key.(string)
-			nKey := int(lvl2Bucket.Key.(float64))
+			nKey, err := toInt(lvl2Bucket.Key)
+			if err != nil {
+				return c, fmt.Errorf("invalid sid aggregation key, %s", err.Error())
+			}
 			// fmt.Println("item1:", sKey, "item2:", nKey)
 			if shouldCollectCategory {
 				subSubTerm, found2 := lvl1Bucket.Terms("subSubTerm")

internal/pkg/dpluger/es7client.go

@@ -95,8 +95,11 @@ func (es *es7Client) CollectPair(plugin Plugin, confFile, sidSource, esFilter, t
 		}
 		for _, lvl2Bucket := range subterm.Buckets {
 			sKey := lvl1Bucket.Key.(string)
-			nKey := int(lvl2Bucket.Key.(float64))
-			// fmt.Println("item1:", sKey, "item2:", nKey)
+			nKey, err := toInt(lvl2Bucket.Key)
+			if err != nil {
+				return c, fmt.Errorf("invalid sid aggregation key, %s", err.Error())
+			}
+
 			if shouldCollectCategory {
 				subSubTerm, found2 := lvl1Bucket.Terms("subSubTerm")
 				if !found2 {
@@ -133,7 +136,7 @@ func (es *es7Client) Collect(plugin Plugin, confFile, sidSource, esFilter, categ
 		for _, v := range coll {
 			s := strings.Split(v, "=")
 			if len(s) != 2 {
-				err = errors.New("Cannot split the ES filter term")
+				err = errors.New("cannot split the ES filter term")
 				return
 			}
 			query = query.Must(elastic7.NewTermQuery(s[0], s[1]))

internal/pkg/dpluger/util.go

@@ -1,8 +1,11 @@
 package dpluger
 
 import (
+	"errors"
 	"fmt"
+	"math"
 	"reflect"
+	"strconv"
 	"strings"
 
 	"github.com/defenxor/dsiem/internal/pkg/dsiem/rule"
@@ -216,3 +219,44 @@ func ruleEqual(rule1, rule2 rule.DirectiveRule) []error {
 
 	return errors
 }
+
+var (
+	ErrIntValueExceedBoundary = errors.New("integer value exceeds maximum value boundary")
+)
+
+// toInt safely convert interface into int.
+func toInt(v interface{}) (int, error) {
+	if v == nil {
+		return 0, nil
+	}
+
+	switch t := v.(type) {
+	case int:
+		return t, nil
+	case float64:
+		if t > 0 && t < math.MaxInt32 {
+			return int(t), nil
+		}
+
+		return 0, ErrIntValueExceedBoundary
+	case int64:
+		if t > 0 && t < math.MaxInt32 {
+			return int(t), nil
+		}
+
+		return 0, ErrIntValueExceedBoundary
+	case string:
+		n, err := strconv.ParseInt(t, 10, 64)
+		if err != nil {
+			return 0, err
+		}
+
+		if n > 0 && n < math.MaxInt32 {
+			return int(n), nil
+		}
+
+		return 0, ErrIntValueExceedBoundary
+	}
+
+	return 0, fmt.Errorf("invalid value type, %T", v)
+}