Perl解析格式错误的XML文件

Question

I am writing a parser for Ossec's rules files in perl.

I am using XML::Simple and it generally works fine, BUT some of the rules files in question are malformed, instead of having a top level <group> <\\group> there are several.

I have read perlfaq : http://perldoc.perl.org/perlfaq6.html#How-can-I-pull-out-lines-between-two-patterns-that-are-themselves-on-different-lines%3f

I can match the text using the example there, but all the matches are grouped.

the CLI code I have for this operation is :

perl -ne 'print if /^<group name/ .. /^<\\group>/' attack_rules.xml

How do I separate the different matches?

Here is a sample malformed XML:

<!-- Privilege scalation messages -->
<group name="syslog,elevation_of_privilege,">
  <rule id="40501" level="15" timeframe="300" frequency="2">
    <if_group>adduser</if_group>
    <if_matched_group>attacks</if_matched_group>
    <description>Attacks followed by the addition </description>
    <description>of an user.</description>
  </rule>
</group> <!-- SYSLOG, ELEVATION_OF_PRIVILEGE, -->



<!-- Scan signatures -->
<group name="syslog,recon,">
  <rule id="40601" level="10" frequency="10" timeframe="90" ignore="90">
    <if_matched_group>connection_attempt</if_matched_group>
    <description>Network scan from same source ip.</description>
    <same_source_ip />
    <info type="link">http://project.honeynet.org/papers/enemy2/</info>
  </rule>
</group> <!-- SYSLOG,SCANS -->

Answer 1

如果唯一的问题是“多个根”，则可以将每个文件内容包装在<root>...</root>并解析结果。