diff --git a/corrector_module/opmon_corrector/corrector_worker.py b/corrector_module/opmon_corrector/corrector_worker.py index a392f79..dd6bca2 100644 --- a/corrector_module/opmon_corrector/corrector_worker.py +++ b/corrector_module/opmon_corrector/corrector_worker.py @@ -71,8 +71,8 @@ def consume_data(self, data): x_request_id = data['x_request_id'] documents = [] for _doc in data['documents']: - sanitised_doc = doc_m.sanitise_document(_doc) - fix_doc = doc_m.correct_structure(sanitised_doc) + sanitized_doc = doc_m.sanitize_document(_doc) + fix_doc = doc_m.correct_structure(sanitized_doc) documents.append(fix_doc) duplicates = 0 @@ -163,8 +163,8 @@ def consume_faulty_data(self, data): # Get parameters # logger_manager = data['logger_manager'] doc_m = data['document_manager'] - sanitised_doc = doc_m.sanitise_document(data['document']) - fixed_doc = doc_m.correct_structure(sanitised_doc) + sanitized_doc = doc_m.sanitize_document(data['document']) + fixed_doc = doc_m.correct_structure(sanitized_doc) producer = fixed_doc if ( fixed_doc['securityServerType'].lower() == SECURITY_SERVER_TYPE_PRODUCER) else None client = fixed_doc if ( diff --git a/corrector_module/opmon_corrector/document_manager.py b/corrector_module/opmon_corrector/document_manager.py index 08165a8..0e61ed2 100644 --- a/corrector_module/opmon_corrector/document_manager.py +++ b/corrector_module/opmon_corrector/document_manager.py @@ -23,8 +23,6 @@ # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. -import bleach - from opmon_corrector import (SECURITY_SERVER_TYPE_CLIENT, SECURITY_SERVER_TYPE_PRODUCER, __version__) from opmon_corrector.logger_manager import LoggerManager @@ -309,17 +307,26 @@ def create_json(client_document, producer_document, x_request_id): } @staticmethod - def sanitise_document(document: dict) -> dict: + def escape_html(value: str) -> str: + """ + Escape html to avoid potential XSS attacks during log processing. + :param value: The string to be escaped. + :return: Returns escaped string. + """ + return value.translate(str.maketrans({'<': '<', '>': '>', '&': '&'})) + + @staticmethod + def sanitize_document(document: dict) -> dict: """ - Sanitizes the document by cleaning string values using bleach if they are present. - :param document: The document to be sanitised. - :return: Returns the sanitised document. + Sanitizes the document by HTML escaping string values if they are present. + :param document: The document to be sanitized. + :return: Returns the sanitized document. """ - sanitised_document = { - key: bleach.clean(value) if isinstance(value, str) else value + sanitized_document = { + key: DocumentManager.escape_html(value) if isinstance(value, str) else value for key, value in document.items() } - return sanitised_document + return sanitized_document def correct_structure(self, doc): """ diff --git a/corrector_module/opmon_corrector/tests/test_document_manager.py b/corrector_module/opmon_corrector/tests/test_document_manager.py index 51024e0..fc62f37 100644 --- a/corrector_module/opmon_corrector/tests/test_document_manager.py +++ b/corrector_module/opmon_corrector/tests/test_document_manager.py @@ -530,9 +530,9 @@ def test_correct_structure(mock_logger_manager, basic_settings): assert all([v is None for v in doc.values()]) -def test_sanitise_document(mock_logger_manager, basic_settings): +def test_sanitize_document(mock_logger_manager, basic_settings): dm = DocumentManager(basic_settings) - sanitised_doc = dm.sanitise_document({ + sanitized_doc = dm.sanitize_document({ 'field1': '', 'field2': 't>', 'field3': 100, @@ -540,7 +540,7 @@ def test_sanitise_document(mock_logger_manager, basic_settings): 'field5': None, 'field6': {'sub': 'test'} }) - assert sanitised_doc == { + assert sanitized_doc == { 'field1': '<img src/onerror=prompt(8)>', 'field2': '</scrip</script>t><img src =q onerror=prompt(8)>', 'field3': 100, diff --git a/corrector_module/setup.py b/corrector_module/setup.py index d21f667..788425d 100644 --- a/corrector_module/setup.py +++ b/corrector_module/setup.py @@ -27,8 +27,7 @@ requirements = [ 'setuptools==67.4.0', 'pymongo==3.10.1', - 'pyyaml==5.4.1', - 'bleach==6.0.0' + 'pyyaml==5.4.1' ] classifiers = [