Skip to content

Commit

Permalink
CNDIT-1708: Fix ATO security vulnerabilities for RTR services (#29)
Browse files Browse the repository at this point in the history
  • Loading branch information
@sveselev
sveselev authored Sep 4, 2024
1 parent b3f9f6e commit a5a4e56
Show file tree
Hide file tree
Showing 5 changed files with 145 additions and 52 deletions.
45 changes: 30 additions & 15 deletions .../main/java/gov/cdc/etldatapipeline/investigation/config/LogDynamicFileAppenderConfig.java
View file
Original file line number Diff line number Diff line change
@@ -1,62 +1,77 @@
package gov.cdc.etldatapipeline.investigation.config;

import ch.qos.logback.core.FileAppender;
import lombok.Setter;

import java.io.File;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.text.SimpleDateFormat;
import java.util.Date;
import java.util.TimeZone;

public class LogDynamicFileAppenderConfig<E> extends FileAppender<E> {

private String logFilePath;

/**
* Helper method used by Logback
* Reading logFilePatch tag from dlt-logback.xml and return value
* */
public void setLogFilePath(String logFilePath) {
this.logFilePath = logFilePath;
}
* Helper method used by Logback
* Reading logFilePatch tag from logback-config.xml and return value
*/
@Setter
private String logFilePath;

/**
* Purpose: Dynamically create log file if not exist
* */
*/
@Override
public void start() {
if (logFilePath == null) {
addError("Log file path is not configured");
return;
}

// Handle date formatting in the log file path
if (logFilePath.contains("%d{")) {
SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd_HH-mm-ss");
dateFormat.setTimeZone(TimeZone.getDefault());
String formattedDate = dateFormat.format(new Date());
logFilePath = logFilePath.replace("%d{yyyy-MM-dd_HH-mm-ss}", formattedDate);
}

File logFile = new File(logFilePath);
if (!logFile.isAbsolute()) {
logFile = new File(System.getProperty("user.dir"), logFilePath);
// Normalize and validate the log file path
Path logDir = Paths.get(System.getProperty("user.dir")); // Define a safe directory for logs
Path normalizedPath;
try {
// Resolve and normalize the logFilePath to ensure it's within the safe directory
normalizedPath = logDir.resolve(logFilePath).normalize();
if (!normalizedPath.startsWith(logDir)) {
addError("Log file path is outside the allowed directory");
return;
}
} catch (Exception e) {
addError("Failed to resolve log file path", e);
return;
}

// Create a File object using the validated and normalized path
File logFile = normalizedPath.toFile();

try {
if (!logFile.exists()) {
Path parentDir = logFile.toPath().getParent();
Files.createDirectories(parentDir);
if (parentDir != null && !Files.exists(parentDir)) {
Files.createDirectories(parentDir);
}
Files.createFile(logFile.toPath());
}
} catch (IOException e) {
addError("Failed to create log file: " + logFilePath, e);
addError("Failed to create log file: " + logFile.getAbsolutePath(), e);
return;
}

setFile(logFile.getAbsolutePath()); // Set the File property with the log file path

super.start();
}
}
}
37 changes: 27 additions & 10 deletions ...ce/src/main/java/gov/cdc/etldatapipeline/ldfdata/config/LogDynamicFileAppenderConfig.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,54 +7,71 @@
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.text.SimpleDateFormat;
import java.util.Date;
import java.util.TimeZone;

@Setter
public class LogDynamicFileAppenderConfig<E> extends FileAppender<E> {

/**
* Helper (setter) method used by Logback
* Reading logFilePatch tag from dlt-logback.xml and return value*
* Helper method used by Logback
* Reading logFilePatch tag from logback-config.xml and return value
*/
@Setter
private String logFilePath;

/**
* Purpose: Dynamically create log file if not exist
* */
*/
@Override
public void start() {
if (logFilePath == null) {
addError("Log file path is not configured");
return;
}

// Handle date formatting in the log file path
if (logFilePath.contains("%d{")) {
SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd_HH-mm-ss");
dateFormat.setTimeZone(TimeZone.getDefault());
String formattedDate = dateFormat.format(new Date());
logFilePath = logFilePath.replace("%d{yyyy-MM-dd_HH-mm-ss}", formattedDate);
}

File logFile = new File(logFilePath);
if (!logFile.isAbsolute()) {
logFile = new File(System.getProperty("user.dir"), logFilePath);
// Normalize and validate the log file path
Path logDir = Paths.get(System.getProperty("user.dir")); // Define a safe directory for logs
Path normalizedPath;
try {
// Resolve and normalize the logFilePath to ensure it's within the safe directory
normalizedPath = logDir.resolve(logFilePath).normalize();
if (!normalizedPath.startsWith(logDir)) {
addError("Log file path is outside the allowed directory");
return;
}
} catch (Exception e) {
addError("Failed to resolve log file path", e);
return;
}

// Create a File object using the validated and normalized path
File logFile = normalizedPath.toFile();

try {
if (!logFile.exists()) {
Path parentDir = logFile.toPath().getParent();
Files.createDirectories(parentDir);
if (parentDir != null && !Files.exists(parentDir)) {
Files.createDirectories(parentDir);
}
Files.createFile(logFile.toPath());
}
} catch (IOException e) {
addError("Failed to create log file: " + logFilePath, e);
addError("Failed to create log file: " + logFile.getAbsolutePath(), e);
return;
}

setFile(logFile.getAbsolutePath()); // Set the File property with the log file path

super.start();
}
}
}
45 changes: 30 additions & 15 deletions ...rc/main/java/gov/cdc/etldatapipeline/observation/config/LogDynamicFileAppenderConfig.java
View file
Original file line number Diff line number Diff line change
@@ -1,57 +1,72 @@
package gov.cdc.etldatapipeline.observation.config;

import ch.qos.logback.core.FileAppender;
import lombok.Setter;

import java.io.File;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.text.SimpleDateFormat;
import java.util.Date;
import java.util.TimeZone;

public class LogDynamicFileAppenderConfig<E> extends FileAppender<E> {

private String logFilePath;

/**
* Helper method used by Logback
* Reading logFilePatch tag from dlt-logback.xml and return value
* */
public void setLogFilePath(String logFilePath) {
this.logFilePath = logFilePath;
}
* Helper method used by Logback
* Reading logFilePatch tag from logback-config.xml and return value
*/
@Setter
private String logFilePath;

/**
* Purpose: Dynamically create log file if not exist
* */
*/
@Override
public void start() {
if (logFilePath == null) {
addError("Log file path is not configured");
return;
}

// Handle date formatting in the log file path
if (logFilePath.contains("%d{")) {
SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd_HH-mm-ss");
dateFormat.setTimeZone(TimeZone.getTimeZone("UTC"));
dateFormat.setTimeZone(TimeZone.getDefault());
String formattedDate = dateFormat.format(new Date());
logFilePath = logFilePath.replace("%d{yyyy-MM-dd_HH-mm-ss}", formattedDate);
}

File logFile = new File(logFilePath);
if (!logFile.isAbsolute()) {
logFile = new File(System.getProperty("user.dir"), logFilePath);
// Normalize and validate the log file path
Path logDir = Paths.get(System.getProperty("user.dir")); // Define a safe directory for logs
Path normalizedPath;
try {
// Resolve and normalize the logFilePath to ensure it's within the safe directory
normalizedPath = logDir.resolve(logFilePath).normalize();
if (!normalizedPath.startsWith(logDir)) {
addError("Log file path is outside the allowed directory");
return;
}
} catch (Exception e) {
addError("Failed to resolve log file path", e);
return;
}

// Create a File object using the validated and normalized path
File logFile = normalizedPath.toFile();

try {
if (!logFile.exists()) {
Path parentDir = logFile.toPath().getParent();
Files.createDirectories(parentDir);
if (parentDir != null && !Files.exists(parentDir)) {
Files.createDirectories(parentDir);
}
Files.createFile(logFile.toPath());
}
} catch (IOException e) {
addError("Failed to create log file: " + logFilePath, e);
addError("Failed to create log file: " + logFile.getAbsolutePath(), e);
return;
}

Expand Down
35 changes: 29 additions & 6 deletions ...c/main/java/gov/cdc/etldatapipeline/organization/config/LogDynamicFileAppenderConfig.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,18 @@
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.text.SimpleDateFormat;
import java.util.Date;
import java.util.TimeZone;

@Setter
public class LogDynamicFileAppenderConfig<E> extends FileAppender<E> {

/**
* Helper method used by Logback
* Reading logFilePatch tag from logback-config.xml and return value
*/
@Setter
private String logFilePath;

/**
Expand All @@ -25,25 +31,42 @@ public void start() {
return;
}

// Handle date formatting in the log file path
if (logFilePath.contains("%d{")) {
SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd_HH-mm-ss");
dateFormat.setTimeZone(TimeZone.getDefault());
String formattedDate = dateFormat.format(new Date());
logFilePath = logFilePath.replace("%d{yyyy-MM-dd_HH-mm-ss}", formattedDate);
}

File logFile = new File(logFilePath);
if (!logFile.isAbsolute()) {
logFile = new File(System.getProperty("user.dir"), logFilePath);
// Normalize and validate the log file path
Path logDir = Paths.get(System.getProperty("user.dir")); // Define a safe directory for logs
Path normalizedPath;
try {
// Resolve and normalize the logFilePath to ensure it's within the safe directory
normalizedPath = logDir.resolve(logFilePath).normalize();
if (!normalizedPath.startsWith(logDir)) {
addError("Log file path is outside the allowed directory");
return;
}
} catch (Exception e) {
addError("Failed to resolve log file path", e);
return;
}

// Create a File object using the validated and normalized path
File logFile = normalizedPath.toFile();

try {
if (!logFile.exists()) {
Path parentDir = logFile.toPath().getParent();
Files.createDirectories(parentDir);
if (parentDir != null && !Files.exists(parentDir)) {
Files.createDirectories(parentDir);
}
Files.createFile(logFile.toPath());
}
} catch (IOException e) {
addError("Failed to create log file: " + logFilePath, e);
addError("Failed to create log file: " + logFile.getAbsolutePath(), e);
return;
}

Expand Down
Loading

0 comments on commit a5a4e56

Please sign in to comment.