jaedonP opened a new pull request, #4074: URL: https://github.com/apache/incubator-kie-tools/pull/4074
## Summary Prevents log forging in the CORS proxy debug output. Proxy request and response headers and the proxied response status were logged with `debug`, which only sanitised the message and printed the argument as is, so a value containing CR/LF characters could inject forged log lines. These calls now use `debugEscapeNewLines`, and `debugEscapeNewLines` now escapes newlines in the serialized argument as well as in the message. ## Changes | File | Change | |------|--------| | packages/cors-proxy/src/proxy/ExpressCorsProxy.ts | log `Proxy Headers`, `Proxy Response status` and `New Response Headers` via `debugEscapeNewLines`; escape newlines in both the message and the JSON-serialized argument | -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
