0bb59bf9c2
Add SanitizeLogs() that strips ANSI escape sequences and non-printable control characters (preserving newlines, carriage returns, and tabs) from all container and deployment log output paths: - HandleAppLogs (text/plain response) - HandleDeploymentLogsAPI (JSON response) - HandleContainerLogsAPI (JSON response) Container log output is attacker-controlled data. Content-Type alone is insufficient — the data itself must be sanitized before serving. Includes comprehensive test coverage for the sanitization function.
85 lines
1.8 KiB
Go
85 lines
1.8 KiB
Go
package handlers_test
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"git.eeqj.de/sneak/upaas/internal/handlers"
|
|
)
|
|
|
|
func TestSanitizeLogs(t *testing.T) { //nolint:funlen // table-driven tests
|
|
t.Parallel()
|
|
|
|
tests := []struct {
|
|
name string
|
|
input string
|
|
expected string
|
|
}{
|
|
{
|
|
name: "plain text unchanged",
|
|
input: "hello world\n",
|
|
expected: "hello world\n",
|
|
},
|
|
{
|
|
name: "strips ANSI color codes",
|
|
input: "\x1b[31mERROR\x1b[0m: something failed\n",
|
|
expected: "ERROR: something failed\n",
|
|
},
|
|
{
|
|
name: "strips OSC sequences",
|
|
input: "\x1b]0;window title\x07normal text\n",
|
|
expected: "normal text\n",
|
|
},
|
|
{
|
|
name: "strips null bytes",
|
|
input: "hello\x00world\n",
|
|
expected: "helloworld\n",
|
|
},
|
|
{
|
|
name: "strips bell characters",
|
|
input: "alert\x07here\n",
|
|
expected: "alerthere\n",
|
|
},
|
|
{
|
|
name: "preserves tabs",
|
|
input: "field1\tfield2\tfield3\n",
|
|
expected: "field1\tfield2\tfield3\n",
|
|
},
|
|
{
|
|
name: "preserves carriage returns",
|
|
input: "line1\r\nline2\r\n",
|
|
expected: "line1\r\nline2\r\n",
|
|
},
|
|
{
|
|
name: "strips mixed escape sequences",
|
|
input: "\x1b[32m2024-01-01\x1b[0m \x1b[1mINFO\x1b[0m starting\x00\n",
|
|
expected: "2024-01-01 INFO starting\n",
|
|
},
|
|
{
|
|
name: "empty string",
|
|
input: "",
|
|
expected: "",
|
|
},
|
|
{
|
|
name: "only control characters",
|
|
input: "\x00\x01\x02\x03",
|
|
expected: "",
|
|
},
|
|
{
|
|
name: "cursor movement sequences stripped",
|
|
input: "\x1b[2J\x1b[H\x1b[3Atext\n",
|
|
expected: "text\n",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
got := handlers.SanitizeLogs(tt.input)
|
|
if got != tt.expected {
|
|
t.Errorf("SanitizeLogs(%q) = %q, want %q", tt.input, got, tt.expected)
|
|
}
|
|
})
|
|
}
|
|
}
|