Mirroristas/owncast
2
0
Fork 0
mirror of https://github.com/owncast/owncast.git synced 2024-10-10 19:16:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Sanitize user submitted values before logging (#2134)

Browse Source 
* strip line breaks from user-submitted values before logging

* finish comment
This commit is contained in:
Matt Owens 2022-09-21 13:03:16 -04:00 committed by Gabe Kangas
parent 29972bb4e7
commit 717bbcf2e7
No known key found for this signature in database
GPG Key ID: 4345B2060657F330
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
core/chat/events.go
View File

@ -36,7 +36,7 @@ func (s *Server) userNameChanged(eventData chatClientEvent) {
normalizedName = strings.ToLower(normalizedName) normalizedName = strings.ToLower(normalizedName)
if strings.Contains(normalizedName, proposedUsername) { if strings.Contains(normalizedName, proposedUsername) {
// Denied. // Denied.
log.Debugln(eventData.client.User.DisplayName, "blocked from changing name to", proposedUsername, "due to blocked name", normalizedName) log.Debugln(logSanitize(eventData.client.User.DisplayName), "blocked from changing name to", logSanitize(proposedUsername), "due to blocked name", normalizedName)
message := fmt.Sprintf("You cannot change your name to **%s**.", proposedUsername) message := fmt.Sprintf("You cannot change your name to **%s**.", proposedUsername)
s.sendActionToClient(eventData.client, message) s.sendActionToClient(eventData.client, message)
@ -138,3 +138,11 @@ func (s *Server) userMessageSent(eventData chatClientEvent) {
eventData.client.MessageCount++ eventData.client.MessageCount++
_lastSeenCache[event.User.ID] = time.Now() _lastSeenCache[event.User.ID] = time.Now()
} }
func logSanitize(userValue string) string {
// strip carriage return and newline from user-submitted values to prevent log injection
sanitizedValue := strings.Replace(userValue, "\n", "", -1)
sanitizedValue = strings.Replace(sanitizedValue, "\r", "", -1)
return fmt.Sprintf("userSuppliedValue(%s)", sanitizedValue)
}

2
core/chat/server.go
View File

@ -355,7 +355,7 @@ func (s *Server) eventReceived(event chatClientEvent) {
s.userNameChanged(event) s.userNameChanged(event)
default: default:
log.Debugln(eventType, "event not found:", typecheck) log.Debugln(logSanitize(fmt.Sprint(eventType)), "event not found:", logSanitize(fmt.Sprint(typecheck)))
} }
} }