This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch bound-diagnostic-and-script-caches in repository https://gitbox.apache.org/repos/asf/unomi.git
commit ecb2b3c8287c27734bac1a303f2f8328266ea973 Author: Serge Huber <[email protected]> AuthorDate: Tue Sep 8 20:32:01 2026 +0200 Write filtered personalization contents back onto the request. sanitizePersonalizations used the filtered contents list only as a non-empty check and kept the original variants. --- .../unomi/rest/endpoints/ContextJsonEndpoint.java | 1 + .../rest/endpoints/ContextJsonEndpointTest.java | 28 ++++++++++++++++++++++ 2 files changed, 29 insertions(+) diff --git a/rest/src/main/java/org/apache/unomi/rest/endpoints/ContextJsonEndpoint.java b/rest/src/main/java/org/apache/unomi/rest/endpoints/ContextJsonEndpoint.java index c36b663dc..8fa5d56d3 100644 --- a/rest/src/main/java/org/apache/unomi/rest/endpoints/ContextJsonEndpoint.java +++ b/rest/src/main/java/org/apache/unomi/rest/endpoints/ContextJsonEndpoint.java @@ -477,6 +477,7 @@ public class ContextJsonEndpoint { List<PersonalizationService.PersonalizedContent> personalizedContents = sanitizePersonalizedContentObjects( personalizationRequest.getContents()); if (personalizedContents != null && !personalizedContents.isEmpty()) { + personalizationRequest.setContents(personalizedContents); result.add(personalizationRequest); } } diff --git a/rest/src/test/java/org/apache/unomi/rest/endpoints/ContextJsonEndpointTest.java b/rest/src/test/java/org/apache/unomi/rest/endpoints/ContextJsonEndpointTest.java index b29946802..3ab24ea60 100644 --- a/rest/src/test/java/org/apache/unomi/rest/endpoints/ContextJsonEndpointTest.java +++ b/rest/src/test/java/org/apache/unomi/rest/endpoints/ContextJsonEndpointTest.java @@ -174,6 +174,34 @@ class ContextJsonEndpointTest { assertTrue(sanitized.isEmpty()); } + @Test + void sanitizePersonalizations_writesFilteredContentsBackWhenSomeAreUnsafe() throws Exception { + PersonalizationService.Filter unsafeFilter = filterWithCondition(conditionWithParameters(Map.of( + "propertyName", "firstName", + "propertyValue", "script::evil"))); + PersonalizationService.Filter safeFilter = filterWithCondition(conditionWithParameters(Map.of( + "propertyName", "firstName", + "propertyValue", "Jane"))); + + PersonalizationService.PersonalizedContent unsafeContent = personalizedContent("injected", unsafeFilter); + PersonalizationService.PersonalizedContent safeContent = personalizedContent("fallback", safeFilter); + + PersonalizationService.PersonalizationRequest request = new PersonalizationService.PersonalizationRequest(); + request.setId("perso-mixed"); + request.setContents(List.of(unsafeContent, safeContent)); + + @SuppressWarnings("unchecked") + List<PersonalizationService.PersonalizationRequest> sanitized = (List<PersonalizationService.PersonalizationRequest>) + invokeSanitizePersonalizations(List.of(request)); + + assertEquals(1, sanitized.size()); + assertEquals("perso-mixed", sanitized.get(0).getId()); + assertEquals(1, sanitized.get(0).getContents().size()); + assertEquals("fallback", sanitized.get(0).getContents().get(0).getId()); + assertEquals(1, request.getContents().size()); + assertEquals("fallback", request.getContents().get(0).getId()); + } + @Test void processOverrides_appliesOverridesOnlyForPersonaProfiles() throws Exception { Persona persona = new Persona();
