Merge pull request #278 from splunk/fix_unintended_whitespace

Fix unintended whitespace

Given the comment that this resolves issues and the only additional fix was removal of a newline in Python file, I am going to merge the PR immediately.

contentctl/objects/abstract_security_content_objects/detection_abstract.py

@@ -83,15 +83,13 @@ def validate_presence_of_filter_macro(cls, value:str, info:ValidationInfo)->str:
 
 
         Args:
-            value (Union[str, dict[str,Any]]): The search. It can either be a string (and should be
-                SPL or a dict, in which case it is Sigma-formatted.
+            value (str): The SPL search. It must be an SPL-formatted string.
             info (ValidationInfo): The validation info can contain a number of different objects.
                 Today it only contains the director.
 
         Returns:
-            Union[str, dict[str,Any]]: The search, either in sigma or SPL format.
-        """        
-
+            str: The search, as an SPL formatted string.
+        """
 
         # Otherwise, the search is SPL.
 

contentctl/output/conf_writer.py

@@ -34,7 +34,10 @@ def escapeNewlines(obj:Any):
         # Failing to do so will result in an improperly formatted conf files that
         # cannot be parsed
         if isinstance(obj,str):
-            return obj.replace(f"\n"," \\\n")
+            # Remove leading and trailing characters. Conf parsers may erroneously 
+            # Parse fields if they have leading or trailing newlines/whitespace and we 
+            # probably don't want that anyway as it doesn't look good in output
+            return obj.strip().replace(f"\n"," \\\n")
         else:
             return obj