python3 perform re.sub against post_body which is of type <class 'bytes'>?

json.loads(post_body) got <class 'dict'> where I could see the contents of json.loads(post_body) in json/text. Question is how to update post_body to mask/substitute some of the json/text and convert it back to original <class 'bytes'> ? I would like to achieve the commented lines, but does not able to without getting "TypeError: a bytes-like object is required, not 'str'" Goal is to have post_body without the actual pwd=secret and password=secret information but substituted by xx Please advise. Thanks.

            self.server.logger.info(json.loads(post_body))

            #if "password" in json.loads(post_body):
            # post_body = re.sub(r"(.*)(pwd=)([a-z,A-Z,0-9]+)(\",\s+)(\"password\":\s+\")(\w+)(.*)",r"\1\2xx\4\5xx\7",str(json.load(post_body))) ???
             
            # Send Event to Splunk via event_writer
            self.server.output_results(json.loads(post_body), self.client_address[0])
    

1 answer

  • answered 2021-04-21 17:16 Mikeht

    Came up with following:

                self.server.logger.info(json.loads(post_body))
    
                if "password" in post_body.decode("utf-8"):
                  post_body_d = re.sub(r"(.*)(pwd=)([a-z,A-Z,0-9]+)(\",\s+)(\"password\":\s+\")(\w+)(.*)",r"\1\2xx\4\5xx\7",post_body.decode("utf-8"))
                  post_body = post_body_d.encode("utf-8")
                # Send Event to Splunk via event_writer
                self.server.output_results(json.loads(post_body), self.client_address[0])