github-advanced-security[bot] commented on code in PR #15652:
URL:
https://github.com/apache/dolphinscheduler/pull/15652#discussion_r1505841576
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java:
##########
@@ -241,8 +221,8 @@
String.format("upload resource: %s file: %s failed.",
name, file.getOriginalFilename()));
} else
ApiServerMetrics.recordApiResourceUploadSize(file.getSize());
- log.info("Upload resource file complete, resourceName:{},
fileName:{}.",
- RegexUtils.escapeNRT(name),
RegexUtils.escapeNRT(file.getOriginalFilename()));
+ log.info("Upload resource file complete, resourceName:{},
fileName:{}.", RegexUtils.escapeNRT(name),
Review Comment:
## Log Injection
This log entry depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/dolphinscheduler/security/code-scanning/3919)
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java:
##########
@@ -241,8 +221,8 @@
String.format("upload resource: %s file: %s failed.",
name, file.getOriginalFilename()));
} else
ApiServerMetrics.recordApiResourceUploadSize(file.getSize());
- log.info("Upload resource file complete, resourceName:{},
fileName:{}.",
- RegexUtils.escapeNRT(name),
RegexUtils.escapeNRT(file.getOriginalFilename()));
+ log.info("Upload resource file complete, resourceName:{},
fileName:{}.", RegexUtils.escapeNRT(name),
+ RegexUtils.escapeNRT(file.getOriginalFilename()));
Review Comment:
## Log Injection
This log entry depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/dolphinscheduler/security/code-scanning/3920)
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java:
##########
@@ -877,8 +822,8 @@
Result<Object> result = new Result<>();
putMsg(result, Status.SUCCESS);
if (checkResourceExists(fullName)) {
- log.error("Resource with same name exists so can not create again,
resourceType:{}, resourceName:{}.",
- type, RegexUtils.escapeNRT(fullName));
+ log.error("Resource with same name exists so can not create again,
resourceType:{}, resourceName:{}.", type,
+ RegexUtils.escapeNRT(fullName));
Review Comment:
## Log Injection
This log entry depends on a [user-provided value](1).
This log entry depends on a [user-provided value](2).
This log entry depends on a [user-provided value](3).
[Show more
details](https://github.com/apache/dolphinscheduler/security/code-scanning/3924)
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java:
##########
@@ -1212,46 +1113,45 @@
}
/**
- * @param fullName resource full name
- * @param tenantCode tenant code
- * @param content content
+ * @param fullName resource full name
+ * @param tenantCode tenant code
+ * @param content content
* @return result
*/
- private Result<Object> uploadContentToStorage(User loginUser, String
fullName, String tenantCode, String content) {
+ private Result<Object> uploadContentToStorage(String fullName, String
tenantCode, String content) {
Result<Object> result = new Result<>();
String localFilename = "";
try {
localFilename = FileUtils.getUploadFilename(tenantCode,
UUID.randomUUID().toString());
if (!FileUtils.writeContent2File(content, localFilename)) {
// write file fail
- log.error("Write file error, fileName:{}, content:{}.",
localFilename,
- RegexUtils.escapeNRT(content));
+ log.error("Write file error, fileName:{}, content:{}.",
localFilename, RegexUtils.escapeNRT(content));
putMsg(result, Status.RESOURCE_NOT_EXIST);
return result;
}
~
~ // get resource file path
~ String resourcePath = storageOperate.getResDir(tenantCode);
~ log.info("resource path is {}, resource dir is {}", fullName,
resourcePath);
~
if (!storageOperate.exists(resourcePath)) {
// create if tenant dir not exists
storageOperate.createTenantDirIfNotExists(tenantCode);
- log.info("Create tenant dir because path {} does not exist,
tenantCode:{}.", resourcePath,
- tenantCode);
+ log.info("Create tenant dir because path {} does not exist,
tenantCode:{}.", resourcePath, tenantCode);
Review Comment:
## Log Injection
This log entry depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/dolphinscheduler/security/code-scanning/3928)
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java:
##########
@@ -1195,14 +1096,14 @@
if (StringUtils.isNotEmpty(resourceViewSuffixes)) {
List<String> strList =
Arrays.asList(resourceViewSuffixes.split(","));
if (!strList.contains(nameSuffix)) {
- log.warn("Resource suffix does not support view, resource full
name:{}, suffix:{}.",
- fullName, nameSuffix);
+ log.warn("Resource suffix does not support view, resource full
name:{}, suffix:{}.", fullName,
Review Comment:
## Log Injection
This log entry depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/dolphinscheduler/security/code-scanning/3925)
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java:
##########
@@ -1212,46 +1113,45 @@
}
/**
- * @param fullName resource full name
- * @param tenantCode tenant code
- * @param content content
+ * @param fullName resource full name
+ * @param tenantCode tenant code
+ * @param content content
* @return result
*/
- private Result<Object> uploadContentToStorage(User loginUser, String
fullName, String tenantCode, String content) {
+ private Result<Object> uploadContentToStorage(String fullName, String
tenantCode, String content) {
Result<Object> result = new Result<>();
String localFilename = "";
try {
localFilename = FileUtils.getUploadFilename(tenantCode,
UUID.randomUUID().toString());
if (!FileUtils.writeContent2File(content, localFilename)) {
// write file fail
- log.error("Write file error, fileName:{}, content:{}.",
localFilename,
- RegexUtils.escapeNRT(content));
+ log.error("Write file error, fileName:{}, content:{}.",
localFilename, RegexUtils.escapeNRT(content));
Review Comment:
## Log Injection
This log entry depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/dolphinscheduler/security/code-scanning/3926)
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java:
##########
@@ -365,8 +341,8 @@
if (file != null) {
// fail upload
if (!upload(loginUser, fullName, file, type)) {
- log.error("Storage operation error, resourceName:{},
originFileName:{}.",
- name,
RegexUtils.escapeNRT(file.getOriginalFilename()));
+ log.error("Storage operation error, resourceName:{},
originFileName:{}.", name,
+ RegexUtils.escapeNRT(file.getOriginalFilename()));
Review Comment:
## Log Injection
This log entry depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/dolphinscheduler/security/code-scanning/3922)
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java:
##########
@@ -1212,46 +1113,45 @@
}
/**
- * @param fullName resource full name
- * @param tenantCode tenant code
- * @param content content
+ * @param fullName resource full name
+ * @param tenantCode tenant code
+ * @param content content
* @return result
*/
- private Result<Object> uploadContentToStorage(User loginUser, String
fullName, String tenantCode, String content) {
+ private Result<Object> uploadContentToStorage(String fullName, String
tenantCode, String content) {
Result<Object> result = new Result<>();
String localFilename = "";
try {
localFilename = FileUtils.getUploadFilename(tenantCode,
UUID.randomUUID().toString());
if (!FileUtils.writeContent2File(content, localFilename)) {
// write file fail
- log.error("Write file error, fileName:{}, content:{}.",
localFilename,
- RegexUtils.escapeNRT(content));
+ log.error("Write file error, fileName:{}, content:{}.",
localFilename, RegexUtils.escapeNRT(content));
Review Comment:
## Log Injection
This log entry depends on a [user-provided value](1).
This log entry depends on a [user-provided value](2).
[Show more
details](https://github.com/apache/dolphinscheduler/security/code-scanning/3927)
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java:
##########
@@ -1212,46 +1113,45 @@
}
/**
- * @param fullName resource full name
- * @param tenantCode tenant code
- * @param content content
+ * @param fullName resource full name
+ * @param tenantCode tenant code
+ * @param content content
* @return result
*/
- private Result<Object> uploadContentToStorage(User loginUser, String
fullName, String tenantCode, String content) {
+ private Result<Object> uploadContentToStorage(String fullName, String
tenantCode, String content) {
Result<Object> result = new Result<>();
String localFilename = "";
try {
localFilename = FileUtils.getUploadFilename(tenantCode,
UUID.randomUUID().toString());
if (!FileUtils.writeContent2File(content, localFilename)) {
// write file fail
- log.error("Write file error, fileName:{}, content:{}.",
localFilename,
- RegexUtils.escapeNRT(content));
+ log.error("Write file error, fileName:{}, content:{}.",
localFilename, RegexUtils.escapeNRT(content));
putMsg(result, Status.RESOURCE_NOT_EXIST);
return result;
}
~
~ // get resource file path
~ String resourcePath = storageOperate.getResDir(tenantCode);
~ log.info("resource path is {}, resource dir is {}", fullName,
resourcePath);
~
if (!storageOperate.exists(resourcePath)) {
// create if tenant dir not exists
storageOperate.createTenantDirIfNotExists(tenantCode);
- log.info("Create tenant dir because path {} does not exist,
tenantCode:{}.", resourcePath,
- tenantCode);
+ log.info("Create tenant dir because path {} does not exist,
tenantCode:{}.", resourcePath, tenantCode);
}
if (storageOperate.exists(fullName)) {
storageOperate.delete(fullName, false);
}
storageOperate.upload(tenantCode, localFilename, fullName, true,
true);
} catch (Exception e) {
- log.error("Upload content to storage error, tenantCode:{},
destFileName:{}.", tenantCode, localFilename,
- e);
+ log.error("Upload content to storage error, tenantCode:{},
destFileName:{}.", tenantCode, localFilename, e);
Review Comment:
## Log Injection
This log entry depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/dolphinscheduler/security/code-scanning/3931)
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java:
##########
@@ -1212,46 +1113,45 @@
}
/**
- * @param fullName resource full name
- * @param tenantCode tenant code
- * @param content content
+ * @param fullName resource full name
+ * @param tenantCode tenant code
+ * @param content content
* @return result
*/
- private Result<Object> uploadContentToStorage(User loginUser, String
fullName, String tenantCode, String content) {
+ private Result<Object> uploadContentToStorage(String fullName, String
tenantCode, String content) {
Result<Object> result = new Result<>();
String localFilename = "";
try {
localFilename = FileUtils.getUploadFilename(tenantCode,
UUID.randomUUID().toString());
if (!FileUtils.writeContent2File(content, localFilename)) {
// write file fail
- log.error("Write file error, fileName:{}, content:{}.",
localFilename,
- RegexUtils.escapeNRT(content));
+ log.error("Write file error, fileName:{}, content:{}.",
localFilename, RegexUtils.escapeNRT(content));
putMsg(result, Status.RESOURCE_NOT_EXIST);
return result;
}
~
~ // get resource file path
~ String resourcePath = storageOperate.getResDir(tenantCode);
~ log.info("resource path is {}, resource dir is {}", fullName,
resourcePath);
~
if (!storageOperate.exists(resourcePath)) {
// create if tenant dir not exists
storageOperate.createTenantDirIfNotExists(tenantCode);
- log.info("Create tenant dir because path {} does not exist,
tenantCode:{}.", resourcePath,
- tenantCode);
+ log.info("Create tenant dir because path {} does not exist,
tenantCode:{}.", resourcePath, tenantCode);
Review Comment:
## Log Injection
This log entry depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/dolphinscheduler/security/code-scanning/3929)
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java:
##########
@@ -877,8 +822,8 @@
Result<Object> result = new Result<>();
putMsg(result, Status.SUCCESS);
if (checkResourceExists(fullName)) {
- log.error("Resource with same name exists so can not create again,
resourceType:{}, resourceName:{}.",
- type, RegexUtils.escapeNRT(fullName));
+ log.error("Resource with same name exists so can not create again,
resourceType:{}, resourceName:{}.", type,
Review Comment:
## Log Injection
This log entry depends on a [user-provided value](1).
This log entry depends on a [user-provided value](2).
[Show more
details](https://github.com/apache/dolphinscheduler/security/code-scanning/3923)
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java:
##########
@@ -365,8 +341,8 @@
if (file != null) {
// fail upload
if (!upload(loginUser, fullName, file, type)) {
- log.error("Storage operation error, resourceName:{},
originFileName:{}.",
- name,
RegexUtils.escapeNRT(file.getOriginalFilename()));
+ log.error("Storage operation error, resourceName:{},
originFileName:{}.", name,
Review Comment:
## Log Injection
This log entry depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/dolphinscheduler/security/code-scanning/3921)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
