flightstats / hub

fault tolerant, highly available service for data storage and distribution
http://www.flightstats.com
MIT License
103 stars 35 forks source link

HUB-1396 : Added sanitization method to fix JS client privacy violation #1404

Closed Haripriya99j closed 3 months ago

Haripriya99j commented 3 months ago

Jira: https://cirium.atlassian.net/browse/HUB-1396

Integration tests: https://ddt-jenkins.prod.flightstats.io/job/run-hub-integration-tests-against-cluster/116/console

System tests: https://ddt-jenkins.prod.flightstats.io/job/run-hub-system-tests/31/

Jenkins build: https://ddt-jenkins.prod.flightstats.io/job/run-hub-development-integration/177/

Explanation for changes: this is a test file which is writtten in JS.

1.Sanitize location:: Before using or logging the location header, we sanitize it using encodeURIComponent to ensure that no sensitive information is exposed.

2.Log Sanitized Data Only: The latestKey is derived from the sanitized location, and only this sanitized version is logged.

3.Additional Safety Check: Added a check to ensure that location is defined before proceeding with encoding and substring operations. By implementing these changes, we ensure that the handling of the location header and the extraction of the latestKey are performed securely, mitigating the risk of privacy violations and inadvertent exposure of sensitive data.