Marmelator/redaction-service
1
0
Fork 0
Code Issues Pull Requests 14 Actions Packages Projects Releases 622 Wiki Activity

Merge branch 'RED-9016' into 'master'

Browse Source 
RED-9016: Leaks regarding the blacklist: Keyword protection insufficient

Closes RED-9016

See merge request redactmanager/redaction-service!407
This commit is contained in:
Maverick Studer 2024-05-22 10:58:16 +02:00
commit 45469a0588
2 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
redaction-service-v1/redaction-service-server-v1/src/main/java/com/iqser/red/service/redaction/v1/server/service/drools/DroolsValidationService.java
View File

@ -9,6 +9,7 @@ import java.util.regex.Pattern;
import java.util.stream.Collectors; import java.util.stream.Collectors;
import java.util.stream.Stream; import java.util.stream.Stream;
import org.apache.commons.lang3.StringUtils;
import org.drools.drl.parser.DroolsParserException; import org.drools.drl.parser.DroolsParserException;
import org.kie.api.builder.KieBuilder; import org.kie.api.builder.KieBuilder;
import org.kie.api.builder.Message; import org.kie.api.builder.Message;
@ -232,11 +233,12 @@ public class DroolsValidationService {
for (RuleClass ruleClass : ruleFileBluePrint.getRuleClasses()) { for (RuleClass ruleClass : ruleFileBluePrint.getRuleClasses()) {
for (RuleUnit ruleUnit : ruleClass.ruleUnits()) { for (RuleUnit ruleUnit : ruleClass.ruleUnits()) {
for (BasicRule basicRule : ruleUnit.rules()) { for (BasicRule basicRule : ruleUnit.rules()) {
List<SearchImplementation.MatchPosition> matches = blacklistedKeywordSearchImplementation.getMatches(basicRule.getCode()); String sanitizedRuleText = StringUtils.deleteWhitespace(basicRule.getCode());
List<SearchImplementation.MatchPosition> matches = blacklistedKeywordSearchImplementation.getMatches(sanitizedRuleText);
if (!matches.isEmpty()) { if (!matches.isEmpty()) {
List<String> foundBlacklistedKeywords = matches.stream() List<String> foundBlacklistedKeywords = matches.stream()
.map(m -> basicRule.getCode().substring(m.startIndex(), m.endIndex())) .map(m -> sanitizedRuleText.substring(m.startIndex(), m.endIndex()))
.distinct() .distinct()
.toList(); .toList();
blacklistErrorMessages.add(DroolsBlacklistErrorMessage.builder() blacklistErrorMessages.add(DroolsBlacklistErrorMessage.builder()

7
redaction-service-v1/redaction-service-server-v1/src/main/resources/drools/blacklist.txt
View File

@ -1,11 +1,12 @@
System. System.
Runtime. Runtime.
Thread. Thread.
ProcessBuilder.
SecurityManager.
ClassLoader.
Class. Class.
ProcessBuilder
SecurityManager
ClassLoader
java.io.File java.io.File
java.nio.file java.nio.file
java.io.Object java.io.Object