[Bug] Rule Toml Write Formatting Wrongly Formats \\\\x

detection_rules/etc/test_toml.json

@@ -48,6 +48,14 @@
       ]
     }
   },
+  {
+    "metadata": {
+      "field": "value"
+    },
+    "rule": {
+      "path": "?:\\\\Windows\\\\Sys?????\\\\x5lrs.dll"
+    }
+  },
   {
     "metadata": {
       "field": "value"

detection_rules/rule_formatter.py

@@ -151,6 +151,9 @@ def dump_str(self, v: str | NonformattedField) -> str:
             return "\n".join([TRIPLE_SQ] + [self._old_dump_str(line)[1:-1] for line in lines] + [TRIPLE_SQ])
         if raw:
             return f"'{lines[0]:s}'"
+        # In the toml library there is a magic replace for \\\\x -> u00 that we wish to avoid until #4979 is resolved
+        if "\\\\x" in v:
+            return f'"{v!s}"'
         return self._old_dump_str(v)
 
     def _dump_flat_list(self, v: Iterable[Any]) -> str:

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "detection_rules"
-version = "1.3.23"
+version = "1.3.24"
 description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
 readme = "README.md"
 requires-python = ">=3.12"

tests/test_toml_formatter.py

@@ -71,4 +71,12 @@ def test_formatter_rule(self):
 
     def test_formatter_deep(self):
         """Test that the data remains unchanged from formatting."""
-        self.compare_test_data(self.test_data[1:])
+        self.compare_test_data(self.test_data[2:])
+
+    def test_formatter_paths(self):
+        """Test that paths are handled as expected in with toml lib."""
+        with self.assertRaisesRegex(
+            AssertionError,
+            r'\+ {"metadata": {"field": "value"}, "rule": {"path": "\?:\\\\Windows\\\\Sys\?\?\?\?\?\\\\x5lrs\.dll"}}',
+        ):
+            self.compare_test_data([self.test_data[1]])