python parsing web access logs

Question

I'm trying to parse a web access logs using the following regex

pattern = re.compile(r"""(?x)^
    (?P<remote_host>\S+)            \s+         # host %h
    \S+                             \s+         # indent %l (unused)
    (?P<remote_user>\S+)            \s+         # user %u
    \[(?P<time_received>.*?)\]      \s+         # time %t
    "(?P<request>.*?)"              \s+         # request "%r"
    (?P<status>[0-9]+)              \s+         # status %>s
    (?P<response_bytes_clf>\S+)     (?:\s+      # size %b (careful, can be '-')
    "(?P<referrer>[^"?\s]*[^"]*)"   \s+         # referrer "%{Referer}i"
    "(?P<user_agent>[^"]*)"         (?:\s+      # user agent "%{User-agent}i"
    "[^"]*"                         )?)?        # optional argument (unused)
$""")

def get_structured_access_log(access_log):
    return pattern.match(access_log).groupdict()

But some of the logs lines contains malicious requests as this ones:

190.2.7.178 - - [21/Dec/2011:05:47:03 +0000] "GET /gnu3/index.php?doc=../../../../../../../proc/self/environ%00 HTTP/1.1" 404 273 "-" "<?php system(\"id\"); ?>"
190.2.7.178 - - [21/Dec/2011:05:47:04 +0000] "GET /gnu/index.php?doc=../../../../../../../proc/self/environ%00 HTTP/1.1" 404 271 "-" "<?php system(\"id\"); ?>"
190.2.7.178 - - [21/Dec/2011:05:47:04 +0000] "GET /phpgwapi/setup/tables_update.inc.php?appdir=../../../../../../../proc/self/environ%00 HTTP/1.1" 404 286 "-" "<?php system(\"id\"); ?>"
190.2.7.178 - - [21/Dec/2011:05:47:05 +0000] "GET /forum/install.php?phpbb_root_dir=../../../../../../../proc/self/environ%00 HTTP/1.1" 404 274 "-" "<?php system(\"id\"); ?>"
190.2.7.178 - - [21/Dec/2011:05:47:06 +0000] "GET /includes/calendar.php?phpc_root_path=../../../../../../../proc/self/environ%00 HTTP/1.1" 404 275 "-" "<?php system(\"id\"); ?>"
190.2.7.178 - - [21/Dec/2011:05:47:06 +0000] "GET /includes/setup.php?phpc_root_path=../../../../../../../proc/self/environ%00 HTTP/1.1" 404 273 "-" "<?php system(\"id\"); ?>"
190.2.7.178 - - [21/Dec/2011:05:47:07 +0000] "GET /inc/authform.inc.php?path_pre=../../../../../../../proc/self/environ%00 HTTP/1.1" 404 275 "-" "<?php system(\"id\"); ?>"
190.2.7.178 - - [21/Dec/2011:05:47:07 +0000] "GET /include/authform.inc.php?path_pre=../../../../../../../proc/self/environ%00 HTTP/1.1" 404 278 "-" "<?php system(\"id\"); ?>"
190.2.7.178 - - [21/Dec/2011:05:47:08 +0000] "GET /index.php?nic=../../../../../../../proc/self/environ%00 HTTP/1.1" 200 4399 "-" "<?php system(\"id\"); ?>"
190.2.7.178 - - [21/Dec/2011:05:47:11 +0000] "GET /index.php?sec=../../../../../../../proc/self/environ%00 HTTP/1.1" 200 4399 "-" "<?php system(\"id\"); ?>"

these request failed to be parsed with the above regex, other normal web requests are parsed successfully.

here are some access logs that is successfully parsed:

123.125.71.79 - - [28/Apr/2012:08:12:57 +0100] "GET /robots.txt HTTP/1.1" 404 268 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
157.56.95.126 - - [28/Apr/2012:10:23:02 +0100] "GET /robots.txt HTTP/1.1" 404 268 "-" "msnbot/2.0b (+http://search.msn.com/msnbot.htm)"
157.56.95.126 - - [28/Apr/2012:10:23:02 +0100] "GET / HTTP/1.1" 200 4399 "-" "msnbot/2.0b (+http://search.msn.com/msnbot.htm)"
110.75.173.193 - - [28/Apr/2012:11:57:26 +0100] "GET / HTTP/1.1" 200 4399 "-" "Yahoo! Slurp China"

exception error message :

'NoneType' object has no attribute 'groupdict'

How can I fix the regex so it can parse these complex requests as well?

About that error, [this page](https://stackoverflow.com/questions/30797220/python-3-x-attributeerror-nonetype-object-has-no-attribute-groupdict) might be helpful. Try replacing the group user_agent to `"(?P.*?)"` [demo](https://regex101.com/r/guiRQY/1) or `.*` if it is the last of the string to match. If the last part is unused, why keep it? — The fourth bird, Apr 20 '19 at 16:41
Yes,I replaced the group user_agent with (?P.*?) and it worked — Manix, Apr 20 '19 at 16:50

The fourth bird · Accepted Answer · 2019-04-20T16:56:09.350

Using re.match will return a corresponding match object or will return None if the string does not match the pattern.

In the first example data, this is the last part containing an escaped double quote "<?php system(\"id\"); ?>"

If you use a negated character class matching not a double quote and want to assert the end of the string, then [^"]* will not get past the first double quote in (\"id

You could fix your pattern by replacing the negated character class to match not a double quote in this part "(?P<user_agent>[^"]*)" to match any character except a new line .*?

Your pattern might look like:

(?x)^
    (?P<remote_host>\S+)            \s+         # host %h
    \S+                             \s+         # indent %l (unused)
    (?P<remote_user>\S+)            \s+         # user %u
    \[(?P<time_received>.*?)\]      \s+         # time %t
    "(?P<request>.*?)"              \s+         # request "%r"
    (?P<status>[0-9]+)              \s+         # status %>s
    (?P<response_bytes_clf>\S+)     (?:\s+      # size %b (careful, can be '-')
    "(?P<referrer>[^"?\s]*[^"]*)"   \s+         # referrer "%{Referer}i"
    "(?P<user_agent>.*?  )"         (?:\s+      # user agent "%{User-agent}i"
    "[^"]*"                         )?)?        # optional argument (unused)
$

Regex demo

thank you, could you please do this also for referrer too? – Manix Apr 20 '19 at 16:55 — Manix, Apr 20 '19 at 16:55

python parsing web access logs

1 Answers1

Linked