DADQL — Damn Another Data Query Language

Query languages are everywhere — from logs to complex softwares.

PocketBase has its own, and since Grroxy uses PocketBase, we updated its filter expression.

DADQL is an updated fork of fexpr.

What's changed in this fork?

Filter map/json data in SQL style
Filter any data in Go using filter — works with any datatype
Regex search — use / to enclose the pattern
Added NOT operator
Use AND OR instead of && || for readability
Comment syntax changed to # (instead of //) — more similar to YAML/Python

Basic Syntax

field operator value

Operators

Operator	Description
`=`	Equals
`!=`	Not equals
`~`	Contains
`!~`	Does not contain
`>`	Greater than
`<`	Less than
`>=`	Greater than or equal
`<=`	Less than or equal

Fields

Top-level

Field	Type	Description
`id`	string	Record ID (e.g. `____________1.9`)
`host`	string	Full host URL
`port`	string	Port number
`index`	number	Request index
`index_minor`	number	Minor index (sub-request)
`is_https`	boolean	Whether the request uses HTTPS
`has_params`	boolean	Whether the URL has query parameters
`is_req_edited`	boolean	Whether the request was edited
`is_resp_edited`	boolean	Whether the response was edited
`created`	string	Timestamp of capture

Request (`req.*`)

Field	Type	Description
`req.method`	string	HTTP method (GET, POST, etc.)
`req.url`	string	Full request URL path with query
`req.path`	string	URL path only
`req.query`	string	Query string
`req.length`	number	Request body length
`req.has_cookies`	boolean	Whether request has cookies
`req.raw`	string	Raw request body
`req.headers.*`	string	Request header value (e.g. `req.headers.Host`)

Response (`resp.*`)

Field	Type	Description
`resp.status`	number	HTTP status code
`resp.mime`	string	Response MIME type
`resp.title`	string	Page title extracted from response
`resp.length`	number	Response body length
`resp.raw`	string	Raw response body
`resp.headers.*`	string	Response header value (e.g. `resp.headers.Content-Type`)

Edited versions

req_edited.* and resp_edited.* have the same fields as req.* and resp.*, containing the modified versions when a request or response has been edited via the interceptor.

Examples

# Find all POST requests
req.method = 'POST'

# Find requests to a specific host
host ~ 'api.example.com'

# Find 4xx errors
resp.status >= 400 AND resp.status < 500

# Find JSON responses
resp.mime ~ 'json'

# Find requests with tokens in the path
req.path ~ 'token'

# Find requests with cookies
req.has_cookies = true

# Find edited requests
is_req_edited = true

Combining Filters

Use AND and OR to combine conditions:

req.method = 'POST' AND resp.status = 200 AND host ~ 'api'

Using with grxp

DADQL works with the grxp CLI tool:

cat urls.txt | grxp -f "scheme = 'https' AND host ~ 'api'"

URL Parser (grxp)

The grxp CLI tool parses and filters URLs:

cat urls.txt | grxp -j -f "scheme = 'https'" -a -r "resp.status = 200"

Options:

-j — JSON output
-f — Filter with DADQL
-a — Probe URLs (check if alive)
-r — Filter responses
-c — Concurrency (default: 50)