From a84e11ee45472661501a762ad20b511eb7f5d692 Mon Sep 17 00:00:00 2001 From: avifro-dev Date: Mon, 16 May 2022 16:38:06 +0300 Subject: [PATCH 1/6] * upgrade Mustache version to 0.9.10 * adding SafeMustacheCustomVisitorFactory * update others to use it also --- pom.xml | 2 +- .../java/io/logz/sawmill/TemplateService.java | 2 ++ .../SafeMustacheCustomVisitorFactory.java | 23 +++++++++++++++++++ .../factories}/UnescapedMustacheFactory.java | 7 +++--- ...nescapedWithJsonStringMustacheFactory.java | 9 ++++---- 5 files changed, 34 insertions(+), 9 deletions(-) create mode 100644 sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/SafeMustacheCustomVisitorFactory.java rename sawmill-core/src/main/java/io/logz/sawmill/{ => mustache/factories}/UnescapedMustacheFactory.java (87%) rename sawmill-core/src/main/java/io/logz/sawmill/{ => mustache/factories}/UnescapedWithJsonStringMustacheFactory.java (88%) diff --git a/pom.xml b/pom.xml index c512bfa7..894428cb 100644 --- a/pom.xml +++ b/pom.xml @@ -143,7 +143,7 @@ com.github.spullara.mustache.java compiler - 0.9.2 + 0.9.10 org.apache.commons diff --git a/sawmill-core/src/main/java/io/logz/sawmill/TemplateService.java b/sawmill-core/src/main/java/io/logz/sawmill/TemplateService.java index 7ef93368..28303ab4 100644 --- a/sawmill-core/src/main/java/io/logz/sawmill/TemplateService.java +++ b/sawmill-core/src/main/java/io/logz/sawmill/TemplateService.java @@ -4,6 +4,8 @@ import com.github.mustachejava.MustacheFactory; import io.logz.sawmill.exceptions.SawmillException; +import io.logz.sawmill.mustache.factories.UnescapedMustacheFactory; +import io.logz.sawmill.mustache.factories.UnescapedWithJsonStringMustacheFactory; import java.io.StringReader; import java.io.StringWriter; import java.util.Arrays; diff --git a/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/SafeMustacheCustomVisitorFactory.java b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/SafeMustacheCustomVisitorFactory.java new file mode 100644 index 00000000..d8946cf4 --- /dev/null +++ b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/SafeMustacheCustomVisitorFactory.java @@ -0,0 +1,23 @@ +package io.logz.sawmill.mustache.factories; + +import com.github.mustachejava.DefaultMustacheVisitor; +import com.github.mustachejava.MustacheException; +import com.github.mustachejava.MustacheVisitor; +import com.github.mustachejava.SafeMustacheFactory; +import com.github.mustachejava.TemplateContext; +import java.util.Set; + +public class SafeMustacheCustomVisitorFactory extends SafeMustacheFactory { + + public SafeMustacheCustomVisitorFactory(Set allowedResourceNames, String resourceRoot) { + super(allowedResourceNames, resourceRoot); + } + + public MustacheVisitor createMustacheVisitor() { + return new DefaultMustacheVisitor(this) { + public void pragma(TemplateContext tc, String pragma, String args) { + throw new MustacheException("Disallowed: pragmas in templates"); + } + }; + } +} diff --git a/sawmill-core/src/main/java/io/logz/sawmill/UnescapedMustacheFactory.java b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedMustacheFactory.java similarity index 87% rename from sawmill-core/src/main/java/io/logz/sawmill/UnescapedMustacheFactory.java rename to sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedMustacheFactory.java index b761e36d..798a0c99 100644 --- a/sawmill-core/src/main/java/io/logz/sawmill/UnescapedMustacheFactory.java +++ b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedMustacheFactory.java @@ -1,9 +1,10 @@ -package io.logz.sawmill; +package io.logz.sawmill.mustache.factories; import com.github.mustachejava.DefaultMustacheFactory; import com.github.mustachejava.MustacheException; import com.github.mustachejava.reflect.ReflectionObjectHandler; +import com.google.common.collect.ImmutableSet; import java.io.IOException; import java.io.Writer; import java.util.List; @@ -11,9 +12,9 @@ import java.util.stream.Collectors; import java.util.stream.IntStream; -public class UnescapedMustacheFactory extends DefaultMustacheFactory { +public class UnescapedMustacheFactory extends SafeMustacheCustomVisitorFactory { public UnescapedMustacheFactory() { - super(); + super(ImmutableSet.of(), "."); this.setObjectHandler(new ListTransformObjectHandler()); } diff --git a/sawmill-core/src/main/java/io/logz/sawmill/UnescapedWithJsonStringMustacheFactory.java b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedWithJsonStringMustacheFactory.java similarity index 88% rename from sawmill-core/src/main/java/io/logz/sawmill/UnescapedWithJsonStringMustacheFactory.java rename to sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedWithJsonStringMustacheFactory.java index b5f08ab2..9de5a23c 100644 --- a/sawmill-core/src/main/java/io/logz/sawmill/UnescapedWithJsonStringMustacheFactory.java +++ b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedWithJsonStringMustacheFactory.java @@ -1,10 +1,9 @@ -package io.logz.sawmill; +package io.logz.sawmill.mustache.factories; -import com.github.mustachejava.DefaultMustacheFactory; import com.github.mustachejava.MustacheException; import com.github.mustachejava.reflect.ReflectionObjectHandler; +import com.google.common.collect.ImmutableSet; import io.logz.sawmill.utilities.JsonUtils; - import java.io.IOException; import java.io.Writer; import java.util.List; @@ -12,9 +11,9 @@ import java.util.stream.Collectors; import java.util.stream.IntStream; -public class UnescapedWithJsonStringMustacheFactory extends DefaultMustacheFactory { +public class UnescapedWithJsonStringMustacheFactory extends SafeMustacheCustomVisitorFactory { public UnescapedWithJsonStringMustacheFactory() { - super(); + super(ImmutableSet.of(), "."); this.setObjectHandler(new ListTransformObjectHandler()); } From 028380eb7dd9ea1bdd7dc6cd4f905b5c8927502a Mon Sep 17 00:00:00 2001 From: avifro-dev Date: Mon, 16 May 2022 16:54:09 +0300 Subject: [PATCH 2/6] fix test --- sawmill-core/src/test/java/io/logz/sawmill/TemplateTest.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sawmill-core/src/test/java/io/logz/sawmill/TemplateTest.java b/sawmill-core/src/test/java/io/logz/sawmill/TemplateTest.java index b6ebc474..ef9bbe7f 100644 --- a/sawmill-core/src/test/java/io/logz/sawmill/TemplateTest.java +++ b/sawmill-core/src/test/java/io/logz/sawmill/TemplateTest.java @@ -1,5 +1,6 @@ package io.logz.sawmill; +import com.github.mustachejava.MustacheException; import com.google.common.collect.ImmutableMap; import org.junit.BeforeClass; import org.junit.Test; @@ -102,7 +103,8 @@ public void testInvalidDateTemplate() { Template template = new TemplateService().createTemplate("Today is {{#dateTemplate}}" + dateFormat + "{{/dateTemplate}}"); Doc doc = createDoc("field1", "value1"); - assertThatThrownBy(() -> template.render(doc)).isInstanceOf(IllegalArgumentException.class); + assertThatThrownBy(() -> template.render(doc)).isInstanceOf(MustacheException.class); + assertThatThrownBy(() -> template.render(doc)).hasCauseExactlyInstanceOf(IllegalArgumentException.class); } @Test From fa1f4b78d7ee2ea8c422a19031e187a2ca949e5e Mon Sep 17 00:00:00 2001 From: avifro-dev Date: Mon, 16 May 2022 20:59:33 +0300 Subject: [PATCH 3/6] adding unit test to make sure we don't allow any file reference --- .../src/test/java/io/logz/sawmill/TemplateTest.java | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/sawmill-core/src/test/java/io/logz/sawmill/TemplateTest.java b/sawmill-core/src/test/java/io/logz/sawmill/TemplateTest.java index ef9bbe7f..47f3fdd3 100644 --- a/sawmill-core/src/test/java/io/logz/sawmill/TemplateTest.java +++ b/sawmill-core/src/test/java/io/logz/sawmill/TemplateTest.java @@ -87,6 +87,13 @@ public void testNullContext() { assertThat(value).isEqualTo(" señor , Have a good day"); } + @Test + public void testInvalidAccessWithMustachePartials() { + assertThatThrownBy(() -> new TemplateService().createTemplate("This is my host file content:\n {{>/etc/hosts}}")) + .isInstanceOf(MustacheException.class) + .hasMessageContaining("Disallowed: resource requested"); + } + @Test public void testDateTemplate() { String dateFormat = "dd.MM.yyyy"; @@ -103,8 +110,8 @@ public void testInvalidDateTemplate() { Template template = new TemplateService().createTemplate("Today is {{#dateTemplate}}" + dateFormat + "{{/dateTemplate}}"); Doc doc = createDoc("field1", "value1"); - assertThatThrownBy(() -> template.render(doc)).isInstanceOf(MustacheException.class); - assertThatThrownBy(() -> template.render(doc)).hasCauseExactlyInstanceOf(IllegalArgumentException.class); + assertThatThrownBy(() -> template.render(doc)).isInstanceOf(MustacheException.class) + .hasCauseExactlyInstanceOf(IllegalArgumentException.class); } @Test From 31d575e022f4200378941bcb1a16702f3404b7a5 Mon Sep 17 00:00:00 2001 From: avifro-dev Date: Tue, 17 May 2022 09:34:45 +0300 Subject: [PATCH 4/6] add small comment --- .../sawmill/mustache/factories/UnescapedMustacheFactory.java | 2 +- .../factories/UnescapedWithJsonStringMustacheFactory.java | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedMustacheFactory.java b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedMustacheFactory.java index 798a0c99..32fbc62d 100644 --- a/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedMustacheFactory.java +++ b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedMustacheFactory.java @@ -14,7 +14,7 @@ public class UnescapedMustacheFactory extends SafeMustacheCustomVisitorFactory { public UnescapedMustacheFactory() { - super(ImmutableSet.of(), "."); + super(ImmutableSet.of(), "."); // disallow any resource reference this.setObjectHandler(new ListTransformObjectHandler()); } diff --git a/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedWithJsonStringMustacheFactory.java b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedWithJsonStringMustacheFactory.java index 9de5a23c..2176a4e8 100644 --- a/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedWithJsonStringMustacheFactory.java +++ b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedWithJsonStringMustacheFactory.java @@ -13,7 +13,7 @@ public class UnescapedWithJsonStringMustacheFactory extends SafeMustacheCustomVisitorFactory { public UnescapedWithJsonStringMustacheFactory() { - super(ImmutableSet.of(), "."); + super(ImmutableSet.of(), "."); // disallow any resource reference this.setObjectHandler(new ListTransformObjectHandler()); } From 0229254113634cc7d721839a860454e8472b114a Mon Sep 17 00:00:00 2001 From: avifro-dev Date: Tue, 17 May 2022 10:15:10 +0300 Subject: [PATCH 5/6] CR feedback --- .../factories/SafeMustacheCustomVisitorFactory.java | 6 +++--- .../mustache/factories/UnescapedMustacheFactory.java | 5 ----- .../factories/UnescapedWithJsonStringMustacheFactory.java | 3 --- 3 files changed, 3 insertions(+), 11 deletions(-) diff --git a/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/SafeMustacheCustomVisitorFactory.java b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/SafeMustacheCustomVisitorFactory.java index d8946cf4..78fb4c24 100644 --- a/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/SafeMustacheCustomVisitorFactory.java +++ b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/SafeMustacheCustomVisitorFactory.java @@ -5,12 +5,12 @@ import com.github.mustachejava.MustacheVisitor; import com.github.mustachejava.SafeMustacheFactory; import com.github.mustachejava.TemplateContext; -import java.util.Set; +import java.util.Collections; public class SafeMustacheCustomVisitorFactory extends SafeMustacheFactory { - public SafeMustacheCustomVisitorFactory(Set allowedResourceNames, String resourceRoot) { - super(allowedResourceNames, resourceRoot); + public SafeMustacheCustomVisitorFactory() { + super(Collections.emptySet(), "."); // disallow any resource reference } public MustacheVisitor createMustacheVisitor() { diff --git a/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedMustacheFactory.java b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedMustacheFactory.java index 32fbc62d..4f454577 100644 --- a/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedMustacheFactory.java +++ b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedMustacheFactory.java @@ -1,10 +1,7 @@ package io.logz.sawmill.mustache.factories; -import com.github.mustachejava.DefaultMustacheFactory; import com.github.mustachejava.MustacheException; import com.github.mustachejava.reflect.ReflectionObjectHandler; - -import com.google.common.collect.ImmutableSet; import java.io.IOException; import java.io.Writer; import java.util.List; @@ -14,8 +11,6 @@ public class UnescapedMustacheFactory extends SafeMustacheCustomVisitorFactory { public UnescapedMustacheFactory() { - super(ImmutableSet.of(), "."); // disallow any resource reference - this.setObjectHandler(new ListTransformObjectHandler()); } diff --git a/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedWithJsonStringMustacheFactory.java b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedWithJsonStringMustacheFactory.java index 2176a4e8..ec8c6d03 100644 --- a/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedWithJsonStringMustacheFactory.java +++ b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/UnescapedWithJsonStringMustacheFactory.java @@ -2,7 +2,6 @@ import com.github.mustachejava.MustacheException; import com.github.mustachejava.reflect.ReflectionObjectHandler; -import com.google.common.collect.ImmutableSet; import io.logz.sawmill.utilities.JsonUtils; import java.io.IOException; import java.io.Writer; @@ -13,8 +12,6 @@ public class UnescapedWithJsonStringMustacheFactory extends SafeMustacheCustomVisitorFactory { public UnescapedWithJsonStringMustacheFactory() { - super(ImmutableSet.of(), "."); // disallow any resource reference - this.setObjectHandler(new ListTransformObjectHandler()); } From 94d223b291e82e77ab8d7a0dd8c4c7b323ff4a4e Mon Sep 17 00:00:00 2001 From: avifro-dev Date: Tue, 17 May 2022 10:17:11 +0300 Subject: [PATCH 6/6] CR feedback --- .../mustache/factories/SafeMustacheCustomVisitorFactory.java | 1 + 1 file changed, 1 insertion(+) diff --git a/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/SafeMustacheCustomVisitorFactory.java b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/SafeMustacheCustomVisitorFactory.java index 78fb4c24..73dd1246 100644 --- a/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/SafeMustacheCustomVisitorFactory.java +++ b/sawmill-core/src/main/java/io/logz/sawmill/mustache/factories/SafeMustacheCustomVisitorFactory.java @@ -13,6 +13,7 @@ public SafeMustacheCustomVisitorFactory() { super(Collections.emptySet(), "."); // disallow any resource reference } + @Override public MustacheVisitor createMustacheVisitor() { return new DefaultMustacheVisitor(this) { public void pragma(TemplateContext tc, String pragma, String args) {