Fix code scanning alert

teragrep / cfe_16

HTTP Event Capture to Syslog bridge

GNU Affero General Public License v3.0

1 stars 3 forks source link

Fix code scanning alert #26

Closed kortemik closed 4 months ago

kortemik commented 4 months ago

Tracking issue for:

[ ] https://github.com/teragrep/cfe_16/security/code-scanning/1

StrongestNumber9 commented 4 months ago

Added a WIP PR for it but why is this implemented by string replacing channel and extras? Is the input format defined by external application because that looks fairly weird.

StrongestNumber9 commented 4 months ago

Looked into it and it seems like input is arbitrary format json-like strings that are string manipulated later on. This is very fragile approach and I think the input should also be either valid json or as different fields so we can leverage existing tools and methods to do the hard work for us. Currently required param is optional but anything except exact match will cause request body cleaner to return invalid json.