Prevent false positives when dealing with heavily nested objects

audit/audit.go

@@ -198,9 +198,21 @@ func GetAllChanges(original interface{}, new interface{}) (map[string]interface{
 					if index := strings.Index(changesJson, split); index > -1 && changesJson != "{" {
 						// Prevent reverse traversal
 						if index > lastOccurrence {
-							lastOccurrence = index
-							lastMatched = split
-							levelsDeep = sIndex
+							// Prevent finding nested keys as opposed to our "change" keys
+							opener := changesJson[index+len(split)+2 : index+len(split)+3]
+							// Prevent a "base level" key from matching a nested key
+							baseLevel := false
+							if index >= 1 {
+								containedBy := changesJson[index-1 : index]
+								if levelsDeep == 0 && (containedBy == "{" || containedBy == "[") {
+									baseLevel = true
+								}
+							}
+							if (opener == "{" || opener == "[") && !baseLevel {
+								lastOccurrence = index
+								lastMatched = split
+								levelsDeep = sIndex
+							}
 						}
 					}
 				}