From 7a25538dfc06a3de3c71ac110e17793d01014420 Mon Sep 17 00:00:00 2001
From: Corey Ogburn <corey.ogburn@securityonionsolutions.com>
Date: Tue, 1 Aug 2023 10:02:59 -0600
Subject: [PATCH] A fix for successfully escaping slashes before ending a
 string in the query parser

This approach recognizes that escaped slashes do not escape other characters such as quotes ending a string.
---
 html/js/routes/hunt.js      |  2 +-
 html/js/routes/hunt.test.js | 10 ++++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/html/js/routes/hunt.js b/html/js/routes/hunt.js
index fbb1e653..8232c258 100644
--- a/html/js/routes/hunt.js
+++ b/html/js/routes/hunt.js
@@ -697,7 +697,7 @@ const huntComponent = {
             break;
           } else if (this.query[i] == "\"" && !escaping) {
             insideQuote = !insideQuote;
-          } else if (this.query[i] == "\\") {
+          } else if (this.query[i] == "\\" && !escaping) {
             escaping = true;
           } else {
             escaping = false;
diff --git a/html/js/routes/hunt.test.js b/html/js/routes/hunt.test.js
index 401149e6..2c9a8a5e 100644
--- a/html/js/routes/hunt.test.js
+++ b/html/js/routes/hunt.test.js
@@ -736,6 +736,16 @@ test('obtainQueryDetails_queryGroupedFilterPipe', () => {
   expect(comp.querySortBys).toStrictEqual([]);
 });
 
+test('obtainQueryDetails_trickyEscapeSequence', () => {
+  comp.query = `process.working_directory:"C:\\\\Windows\\\\system32\\\\" | groupby host.name`;
+  comp.obtainQueryDetails();
+  expect(comp.queryName).toBe("Custom");
+  expect(comp.queryFilters).toStrictEqual([`process.working_directory:"C:\\\\Windows\\\\system32\\\\"`]);
+  expect(comp.queryGroupBys).toStrictEqual([["host.name"]]);
+  expect(comp.queryGroupByOptions).toStrictEqual([[]]);
+  expect(comp.querySortBys).toStrictEqual([]);
+});
+
 test('query string filterToggles', () => {
   comp.$route = { path: "hunt", query: { socExcludeToggle: false } };
   comp.filterToggles = [{