chore: try to stress test dns #2987
Conversation
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| res.on('data', (data) => {}) | ||
| }); | ||
| req.on('error', (e) => { | ||
| console.log(`problem with request ${id} : ${e.code} ${e.message}`); |
Check warning
Code scanning / CodeQL
Log injection Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 month ago
To fix the log injection issue, any user-influenced content being logged should have line breaks removed so that attackers cannot forge additional log lines. In this case, before logging e.code and e.message, we should sanitize them by removing or replacing newline and carriage return characters. The ideal approach is to introduce a small helper function to sanitize strings and apply it to every user-controlled input in the log. This edit will be made directly within the request function's error handler in stress_dns.cjs.
No edits to overall functionality or broader architecture are required, just this minor sanitization step and possibly a helper function.
| @@ -10,6 +10,14 @@ | ||
| } | ||
| } | ||
|
|
||
| function sanitizeLog(str) { | ||
| if (typeof str !== 'string') { | ||
| return String(str); | ||
| } | ||
| // Remove CR and LF characters | ||
| return str.replace(/[\r\n]+/g, ' '); | ||
| } | ||
|
|
||
| function request() { | ||
| var id = ++count; | ||
| if (id > 10000) process.exit() | ||
| @@ -22,7 +30,9 @@ | ||
| res.on('data', (data) => {}) | ||
| }); | ||
| req.on('error', (e) => { | ||
| console.log(`problem with request ${id} : ${e.code} ${e.message}`); | ||
| console.log( | ||
| `problem with request ${id} : ${sanitizeLog(e.code)} ${sanitizeLog(e.message)}` | ||
| ); | ||
| console.log(e) | ||
| }); | ||
| } |
| }); | ||
| req.on('error', (e) => { | ||
| console.log(`problem with request ${id} : ${e.code} ${e.message}`); | ||
| console.log(e) |
Check warning
Code scanning / CodeQL
Log injection Medium
1 participant
Problem
Issue number, if available:
Changes
Corresponding docs PR, if applicable:
Validation
Checklist
run-e2elabel set.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.