plugin/in_http: recognize CSP reports as JSON data

To make it easy to use fluentd for CSP reporting, let's parse retrieved data as JSON if the content type is `application/csp-report`. It is guaranteed to be a well formatted JSON according to the specification. Signed-off-by: Giedrius Statkevičius <[email protected]>
fluent · Aug 29, 2023 · 86ebfd3 · 86ebfd3
1 parent d5685ad
commit 86ebfd3
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 2 deletions.
diff --git a/lib/fluent/plugin/in_http.rb b/lib/fluent/plugin/in_http.rb
@@ -573,14 +573,16 @@ def on_message_complete
           params.update WEBrick::HTTPUtils.parse_form_data(@body, boundary)
         elsif /^application\/json/.match?(@content_type)
           params['json'] = @body
+        elsif /^application\/csp-report/.match?(@content_type)
+          params['json'] = @body
         elsif /^application\/msgpack/.match?(@content_type)
           params['msgpack'] = @body
         elsif /^application\/x-ndjson/.match?(@content_type)
           params['ndjson'] = @body
         end
         path_info = uri.path
 
-        if (@add_query_params) 
+        if (@add_query_params)
 
           query_params = WEBrick::HTTPUtils.parse_query(uri.query)
 

diff --git a/test/plugin/test_in_http.rb b/test/plugin/test_in_http.rb
@@ -517,6 +517,28 @@ def test_application_json
     assert_equal_event_time time, d.events[1][1]
   end
 
+  def test_csp_report
+    d = create_driver
+    time = event_time("2011-01-02 13:14:15 UTC")
+    time_i = time.to_i
+    events = [
+      ["tag1", time, {"a"=>1}],
+      ["tag2", time, {"a"=>2}],
+    ]
+    res_codes = []
+
+    d.run(expect_records: 2) do
+      events.each do |tag, t, record|
+        res = post("/#{tag}?time=#{time_i.to_s}", record.to_json, {"Content-Type"=>"application/csp-report; charset=utf-8"})
+        res_codes << res.code
+      end
+    end
+    assert_equal ["200", "200"], res_codes
+    assert_equal events, d.events
+    assert_equal_event_time time, d.events[0][1]
+    assert_equal_event_time time, d.events[1][1]
+  end
+
   def test_application_msgpack
     d = create_driver
     time = event_time("2011-01-02 13:14:15 UTC")
@@ -982,7 +1004,7 @@ def test_cors_disallowed
     assert_equal ["403", "403"], res_codes
   end
 
-  def test_add_query_params 
+  def test_add_query_params
     d = create_driver(config + "add_query_params true")
     assert_equal true, d.instance.add_query_params