Merge pull request #124 from madflojo/sanitize-logs

Adding log sanitization

pkg/app/server.go

@@ -10,6 +10,7 @@ import (
 	"github.com/julienschmidt/httprouter"
 	"github.com/sirupsen/logrus"
 	"github.com/tarmac-project/tarmac/pkg/config"
+	"github.com/tarmac-project/tarmac/pkg/sanitize"
 )
 
 // isPProf is a regex that validates if the given path is used for PProf
@@ -50,7 +51,7 @@ func (srv *Server) middleware(n httprouter.Handle) httprouter.Handle {
 			"remote-addr":    r.RemoteAddr,
 			"http-protocol":  r.Proto,
 			"content-length": r.ContentLength,
-		}).Debugf("HTTP Request to %s received", r.URL.EscapedPath())
+		}).Debugf("HTTP Request to %s received", sanitize.String(r.URL.EscapedPath()))
 
 		// Verify if PProf
 		if isPProf.MatchString(r.URL.EscapedPath()) && !srv.cfg.GetBool("enable_pprof") {
@@ -76,7 +77,7 @@ func (srv *Server) middleware(n httprouter.Handle) httprouter.Handle {
 			"http-protocol":  r.Proto,
 			"content-length": r.ContentLength,
 			"duration":       time.Since(now).Milliseconds(),
-		}).Debugf("HTTP Request to %s complete", r.URL.EscapedPath())
+		}).Debugf("HTTP Request to %s complete", sanitize.String(r.URL.EscapedPath()))
 	}
 }
 

pkg/sanitize/sanitize.go

@@ -0,0 +1,13 @@
+/*
+Package sanitize provides functions to sanitize user input into a safe format.
+*/
+package sanitize
+
+import (
+	"strings"
+)
+
+// String sanitizes a string by removing newline characters.
+func String(s string) string {
+	return strings.ReplaceAll(strings.ReplaceAll(s, "\r", ""), "\n", "")
+}

pkg/sanitize/sanitize_test.go

@@ -0,0 +1,26 @@
+package sanitize
+
+import (
+	"testing"
+)
+
+type TestCase struct {
+	input    string
+	expected string
+}
+
+func TestSanitize(t *testing.T) {
+	tt := []TestCase{
+		{"hello\nworld", "helloworld"},
+		{"hello\rworld", "helloworld"},
+		{"hello\r\nworld", "helloworld"},
+		{"hello world", "hello world"},
+		{`{ "hello": "world" }`, `{ "hello": "world" }`},
+	}
+
+	for _, tc := range tt {
+		if got := String(tc.input); got != tc.expected {
+			t.Errorf("Sanitize(%s) = %s; want %s", tc.input, got, tc.expected)
+		}
+	}
+}