-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Escape double quotes in all strings, not just top level model strings (…
…#20318) * Escape double quotes in all strings, not just top level model strings
- Loading branch information
1 parent
68a626d
commit bd99287
Showing
5 changed files
with
181 additions
and
24 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| type = "fixed" | ||
| message = "Fixed issue where unescaped quotes in Custom HTTP notification JSON payloads breaks the notifications." | ||
|
|
||
| pulls = ["19951"] | ||
| pulls = ["19951", "20318"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
55 changes: 55 additions & 0 deletions
55
graylog2-server/src/main/java/org/graylog2/bindings/providers/JsonSafeEngineProvider.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| /* | ||
| * Copyright (C) 2020 Graylog, Inc. | ||
| * | ||
| * This program is free software: you can redistribute it and/or modify | ||
| * it under the terms of the Server Side Public License, version 1, | ||
| * as published by MongoDB, Inc. | ||
| * | ||
| * This program is distributed in the hope that it will be useful, | ||
| * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| * Server Side Public License for more details. | ||
| * | ||
| * You should have received a copy of the Server Side Public License | ||
| * along with this program. If not, see | ||
| * <http://www.mongodb.com/licensing/server-side-public-license>. | ||
| */ | ||
| package org.graylog2.bindings.providers; | ||
|
|
||
| import com.floreysoft.jmte.Engine; | ||
| import com.floreysoft.jmte.Renderer; | ||
| import jakarta.inject.Inject; | ||
| import jakarta.inject.Provider; | ||
| import jakarta.inject.Singleton; | ||
| import org.apache.commons.lang.StringEscapeUtils; | ||
|
|
||
| import java.util.Locale; | ||
| import java.util.Map; | ||
|
|
||
| @Singleton | ||
| public class JsonSafeEngineProvider implements Provider<Engine> { | ||
| private final Engine engine; | ||
|
|
||
| @Inject | ||
| public JsonSafeEngineProvider() { | ||
| engine = Engine.createEngine(); | ||
| engine.registerRenderer(String.class, new JsonSafeRenderer()); | ||
| } | ||
| @Override | ||
| public Engine get() { | ||
| return engine; | ||
| } | ||
|
|
||
| private static class JsonSafeRenderer implements Renderer<String> { | ||
|
|
||
| @Override | ||
| public String render(String s, Locale locale, Map<String, Object> map) { | ||
| // Current version of Apache Commons does not have native support for escapeJson. However, | ||
| // https://commons.apache.org/proper/commons-text/javadocs/api-release/org/apache/commons/text/StringEscapeUtils.html#escapeJson(java.lang.String) | ||
| // current Apache Commons docs states: | ||
| // 'The only difference between Java strings and Json strings is that in Json, forward-slash (/) is escaped.' | ||
| // So we use escapeJava and tack on an extra String.replace() call to escape forward slashes. | ||
| return StringEscapeUtils.escapeJava(s).replace("/", "\\/"); | ||
| } | ||
| } | ||
| } |
94 changes: 94 additions & 0 deletions
94
...ver/src/test/java/org/graylog/events/notifications/types/HTTPEventNotificationV2Test.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| /* | ||
| * Copyright (C) 2020 Graylog, Inc. | ||
| * | ||
| * This program is free software: you can redistribute it and/or modify | ||
| * it under the terms of the Server Side Public License, version 1, | ||
| * as published by MongoDB, Inc. | ||
| * | ||
| * This program is distributed in the hope that it will be useful, | ||
| * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| * Server Side Public License for more details. | ||
| * | ||
| * You should have received a copy of the Server Side Public License | ||
| * along with this program. If not, see | ||
| * <http://www.mongodb.com/licensing/server-side-public-license>. | ||
| */ | ||
| package org.graylog.events.notifications.types; | ||
|
|
||
| import com.fasterxml.jackson.core.JsonProcessingException; | ||
| import com.floreysoft.jmte.Engine; | ||
| import com.google.common.collect.ImmutableList; | ||
| import org.graylog.events.configuration.EventsConfigurationProvider; | ||
| import org.graylog.events.notifications.EventNotificationService; | ||
| import org.graylog2.bindings.providers.JsonSafeEngineProvider; | ||
| import org.graylog2.notifications.NotificationService; | ||
| import org.graylog2.plugin.Message; | ||
| import org.graylog2.plugin.MessageSummary; | ||
| import org.graylog2.plugin.TestMessageFactory; | ||
| import org.graylog2.plugin.system.NodeId; | ||
| import org.graylog2.security.encryption.EncryptedValueService; | ||
| import org.graylog2.shared.bindings.providers.ObjectMapperProvider; | ||
| import org.graylog2.shared.bindings.providers.ParameterizedHttpClientProvider; | ||
| import org.graylog2.system.urlwhitelist.UrlWhitelistNotificationService; | ||
| import org.graylog2.system.urlwhitelist.UrlWhitelistService; | ||
| import org.joda.time.DateTime; | ||
| import org.joda.time.DateTimeZone; | ||
| import org.junit.jupiter.api.BeforeEach; | ||
| import org.junit.jupiter.api.Test; | ||
| import org.mockito.Mock; | ||
|
|
||
| import java.io.UnsupportedEncodingException; | ||
| import java.util.Map; | ||
|
|
||
| import static org.assertj.core.api.Assertions.assertThat; | ||
|
|
||
| public class HTTPEventNotificationV2Test { | ||
| @Mock | ||
| private EventNotificationService notificationCallbackService; | ||
| @Mock | ||
| private ObjectMapperProvider objectMapperProvider; | ||
| @Mock | ||
| private UrlWhitelistService whitelistService; | ||
| @Mock | ||
| private UrlWhitelistNotificationService urlWhitelistNotificationService; | ||
| @Mock | ||
| private EncryptedValueService encryptedValueService; | ||
| @Mock | ||
| private EventsConfigurationProvider configurationProvider; | ||
| @Mock | ||
| private ParameterizedHttpClientProvider parameterizedHttpClientProvider; | ||
| @Mock | ||
| private NotificationService notificationService; | ||
| @Mock | ||
| private NodeId nodeId; | ||
|
|
||
| private HTTPEventNotificationV2 notification; | ||
|
|
||
| @BeforeEach | ||
| void setUp() { | ||
| notification = new HTTPEventNotificationV2(notificationCallbackService, objectMapperProvider, | ||
| whitelistService, urlWhitelistNotificationService, encryptedValueService, configurationProvider, | ||
| new Engine(), new JsonSafeEngineProvider().get(), notificationService, nodeId, | ||
| parameterizedHttpClientProvider); | ||
| } | ||
|
|
||
| @Test | ||
| public void testEscapedQuotesInBacklog() throws UnsupportedEncodingException, JsonProcessingException { | ||
| Map<String, Object> model = Map.of( | ||
| "event_definition_title", "<<Test Event Title>>", | ||
| "event", Map.of("message", "Event Message & Whatnot"), | ||
| "backlog", createBacklog() | ||
| ); | ||
| String bodyTemplate = "${if backlog}{\"backlog\": [${foreach backlog message}{ \"title\": \"Message\", \"value\": \"${message.message}\" }${if last_message}${else},${end}${end}]}${end}"; | ||
| String body = notification.transformBody(bodyTemplate, HTTPEventNotificationConfigV2.ContentType.JSON, model); | ||
| assertThat(body).contains("\"value\": \"Message with \\\"Double Quotes\\\""); | ||
| } | ||
|
|
||
| private ImmutableList<MessageSummary> createBacklog() { | ||
| Message message = new TestMessageFactory().createMessage("Message with \"Double Quotes\"", "Unit Test", DateTime.now(DateTimeZone.UTC)); | ||
| MessageSummary summary = new MessageSummary("index1", message); | ||
| return ImmutableList.of(summary); | ||
| } | ||
|
|
||
| } |