diff --git a/corrector_module/opmon_corrector/corrector_worker.py b/corrector_module/opmon_corrector/corrector_worker.py
index a392f79..dd6bca2 100644
--- a/corrector_module/opmon_corrector/corrector_worker.py
+++ b/corrector_module/opmon_corrector/corrector_worker.py
@@ -71,8 +71,8 @@ def consume_data(self, data):
x_request_id = data['x_request_id']
documents = []
for _doc in data['documents']:
- sanitised_doc = doc_m.sanitise_document(_doc)
- fix_doc = doc_m.correct_structure(sanitised_doc)
+ sanitized_doc = doc_m.sanitize_document(_doc)
+ fix_doc = doc_m.correct_structure(sanitized_doc)
documents.append(fix_doc)
duplicates = 0
@@ -163,8 +163,8 @@ def consume_faulty_data(self, data):
# Get parameters
# logger_manager = data['logger_manager']
doc_m = data['document_manager']
- sanitised_doc = doc_m.sanitise_document(data['document'])
- fixed_doc = doc_m.correct_structure(sanitised_doc)
+ sanitized_doc = doc_m.sanitize_document(data['document'])
+ fixed_doc = doc_m.correct_structure(sanitized_doc)
producer = fixed_doc if (
fixed_doc['securityServerType'].lower() == SECURITY_SERVER_TYPE_PRODUCER) else None
client = fixed_doc if (
diff --git a/corrector_module/opmon_corrector/document_manager.py b/corrector_module/opmon_corrector/document_manager.py
index 08165a8..0e61ed2 100644
--- a/corrector_module/opmon_corrector/document_manager.py
+++ b/corrector_module/opmon_corrector/document_manager.py
@@ -23,8 +23,6 @@
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
# THE SOFTWARE.
-import bleach
-
from opmon_corrector import (SECURITY_SERVER_TYPE_CLIENT,
SECURITY_SERVER_TYPE_PRODUCER, __version__)
from opmon_corrector.logger_manager import LoggerManager
@@ -309,17 +307,26 @@ def create_json(client_document, producer_document, x_request_id):
}
@staticmethod
- def sanitise_document(document: dict) -> dict:
+ def escape_html(value: str) -> str:
+ """
+ Escape html to avoid potential XSS attacks during log processing.
+ :param value: The string to be escaped.
+ :return: Returns escaped string.
+ """
+ return value.translate(str.maketrans({'<': '<', '>': '>', '&': '&'}))
+
+ @staticmethod
+ def sanitize_document(document: dict) -> dict:
"""
- Sanitizes the document by cleaning string values using bleach if they are present.
- :param document: The document to be sanitised.
- :return: Returns the sanitised document.
+ Sanitizes the document by HTML escaping string values if they are present.
+ :param document: The document to be sanitized.
+ :return: Returns the sanitized document.
"""
- sanitised_document = {
- key: bleach.clean(value) if isinstance(value, str) else value
+ sanitized_document = {
+ key: DocumentManager.escape_html(value) if isinstance(value, str) else value
for key, value in document.items()
}
- return sanitised_document
+ return sanitized_document
def correct_structure(self, doc):
"""
diff --git a/corrector_module/opmon_corrector/tests/test_document_manager.py b/corrector_module/opmon_corrector/tests/test_document_manager.py
index 51024e0..fc62f37 100644
--- a/corrector_module/opmon_corrector/tests/test_document_manager.py
+++ b/corrector_module/opmon_corrector/tests/test_document_manager.py
@@ -530,9 +530,9 @@ def test_correct_structure(mock_logger_manager, basic_settings):
assert all([v is None for v in doc.values()])
-def test_sanitise_document(mock_logger_manager, basic_settings):
+def test_sanitize_document(mock_logger_manager, basic_settings):
dm = DocumentManager(basic_settings)
- sanitised_doc = dm.sanitise_document({
+ sanitized_doc = dm.sanitize_document({
'field1': '',
'field2': 't>',
'field3': 100,
@@ -540,7 +540,7 @@ def test_sanitise_document(mock_logger_manager, basic_settings):
'field5': None,
'field6': {'sub': 'test'}
})
- assert sanitised_doc == {
+ assert sanitized_doc == {
'field1': '<img src/onerror=prompt(8)>',
'field2': '</scrip</script>t><img src =q onerror=prompt(8)>',
'field3': 100,
diff --git a/corrector_module/setup.py b/corrector_module/setup.py
index d21f667..788425d 100644
--- a/corrector_module/setup.py
+++ b/corrector_module/setup.py
@@ -27,8 +27,7 @@
requirements = [
'setuptools==67.4.0',
'pymongo==3.10.1',
- 'pyyaml==5.4.1',
- 'bleach==6.0.0'
+ 'pyyaml==5.4.1'
]
classifiers = [