Merge pull request #124 from madflojo/sanitize-logs

Adding log sanitization

pkg/app/server.go

@@ -10,6 +10,7 @@ import (
  "github.com/julienschmidt/httprouter"
  "github.com/sirupsen/logrus"
  "github.com/tarmac-project/tarmac/pkg/config"
+ "github.com/tarmac-project/tarmac/pkg/sanitize"
 )
 
 // isPProf is a regex that validates if the given path is used for PProf
@@ -50,7 +51,7 @@ func (srv *Server) middleware(n httprouter.Handle) httprouter.Handle {
  "remote-addr": r.RemoteAddr,
  "http-protocol": r.Proto,
  "content-length": r.ContentLength,
- }).Debugf("HTTP Request to %s received", r.URL.EscapedPath())
+ }).Debugf("HTTP Request to %s received", sanitize.String(r.URL.EscapedPath()))
 
  // Verify if PProf
  if isPProf.MatchString(r.URL.EscapedPath()) && !srv.cfg.GetBool("enable_pprof") {
@@ -76,7 +77,7 @@ func (srv *Server) middleware(n httprouter.Handle) httprouter.Handle {
  "http-protocol": r.Proto,
  "content-length": r.ContentLength,
  "duration": time.Since(now).Milliseconds(),
- }).Debugf("HTTP Request to %s complete", r.URL.EscapedPath())
+ }).Debugf("HTTP Request to %s complete", sanitize.String(r.URL.EscapedPath()))
  }
 }
 

pkg/sanitize/sanitize.go

@@ -0,0 +1,13 @@
+/*
+Package sanitize provides functions to sanitize user input into a safe format.
+*/
+package sanitize
+
+import (
+ "strings"
+)
+
+// String sanitizes a string by removing newline characters.
+func String(s string) string {
+ return strings.ReplaceAll(strings.ReplaceAll(s, "\r", ""), "\n", "")
+}

pkg/sanitize/sanitize_test.go

@@ -0,0 +1,26 @@
+package sanitize
+
+import (
+ "testing"
+)
+
+type TestCase struct {
+ input string
+ expected string
+}
+
+func TestSanitize(t *testing.T) {
+ tt := []TestCase{
+ {"hello\nworld", "helloworld"},
+ {"hello\rworld", "helloworld"},
+ {"hello\r\nworld", "helloworld"},
+ {"hello world", "hello world"},
+ {`{ "hello": "world" }`, `{ "hello": "world" }`},
+ }
+
+ for _, tc := range tt {
+ if got := String(tc.input); got != tc.expected {
+ t.Errorf("Sanitize(%s) = %s; want %s", tc.input, got, tc.expected)
+ }
+ }
+}