diff --git a/sigma/backends/sqlite/sqlite.py b/sigma/backends/sqlite/sqlite.py index 4bac13c..180efe3 100644 --- a/sigma/backends/sqlite/sqlite.py +++ b/sigma/backends/sqlite/sqlite.py @@ -13,6 +13,7 @@ ) from sigma.types import ( SigmaCompareExpression, + SigmaRegularExpression, SigmaString, SpecialChars, SigmaCIDRExpression, @@ -477,6 +478,12 @@ def convert_value_str( else: return converted + def convert_value_re( + self, r: SigmaRegularExpression, state: ConversionState + ) -> str: + # Doubling single quotes is mandatory: the regex is embedded in a '...' SQL string literal. + return super().convert_value_re(r, state).replace("'", "''") + def convert_condition_field_eq_val_str( self, cond: ConditionFieldEqualsValueExpression, state: ConversionState ) -> Union[str, DeferredQueryExpression]: diff --git a/tests/test_backend_sqlite.py b/tests/test_backend_sqlite.py index c69f4f0..eb01a0d 100644 --- a/tests/test_backend_sqlite.py +++ b/tests/test_backend_sqlite.py @@ -163,6 +163,27 @@ def test_sqlite_regex_query(sqlite_backend: sqliteBackend): ) +def test_sqlite_regex_query_single_quote(sqlite_backend: sqliteBackend): + assert ( + sqlite_backend.convert( + SigmaCollection.from_yaml( + """ + title: Test + status: test + logsource: + category: test_category + product: test_product + detection: + sel: + fieldA|re: it's.exe + condition: sel + """ + ) + ) + == ["SELECT * FROM WHERE fieldA REGEXP 'it''s.exe'"] + ) + + def test_sqlite_cidr_query(sqlite_backend: sqliteBackend): assert ( sqlite_backend.convert(