jaedonP opened a new pull request, #7268:
URL: https://github.com/apache/incubator-kie/pull/7268
## Summary
`DataAuditQuery.toString()` only replaced line terminators in user-supplied
values, so other control characters (tab, null byte and so on) could still
reach the log. Replace all control characters with an underscore.
## Changes
| File | Change |
| --- | --- |
| `DataAuditQuery.java` | `replaceAll("\\R+", "_")` becomes
`replaceAll("[\\p{Cntrl}]+", "_")` |
| `DataAuditQueryTest.java` | New unit tests covering null fields, clean
input, single and consecutive control characters, and a log forging payload |
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
