Marmelator/redaction-service
1
0
Fork 0
Code Issues Pull Requests 14 Actions Packages Projects Releases 622 Wiki Activity

RED-9350- Prohibit access to tenant context in rule execution

Browse Source
This commit is contained in:
Corina Olariu 2024-06-18 12:42:59 +02:00
parent f8cfc4bd1a
commit 9d7c1a6157
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
redaction-service-v1/redaction-service-server-v1/src/main/resources/drools/blacklist.txt
View File

@ -3,6 +3,7 @@ Runtime.
Thread. Thread.
Class. Class.
TenantContext
ProcessBuilder ProcessBuilder
SecurityManager SecurityManager
ClassLoader ClassLoader

8
redaction-service-v1/redaction-service-server-v1/src/test/java/com/iqser/red/service/redaction/v1/server/drools/files/management/services/DroolsValidationServiceTest.java
View File

@ -373,6 +373,11 @@ class DroolsValidationServiceTest {
String rulesString = new String(rulesFile.getInputStream().readAllBytes()); String rulesString = new String(rulesFile.getInputStream().readAllBytes());
String globalStart = "\nglobal Document document";
String importTenantContext = "import com.knecon.fforesight.tenantcommons.TenantContext;\n";
int indexGlobalStart = rulesString.indexOf(globalStart);
rulesString = rulesString.substring(0, indexGlobalStart) + importTenantContext + rulesString.substring(indexGlobalStart);
String evilRule = """ String evilRule = """
//------------------------------------ All the evil rules ------------------------------------ //------------------------------------ All the evil rules ------------------------------------
@ -383,6 +388,7 @@ class DroolsValidationServiceTest {
when when
$fileAttribute: FileAttribute($label: label, $value: value) $fileAttribute: FileAttribute($label: label, $value: value)
$duplicate: FileAttribute(this != $fileAttribute, label == $label, value == $value) $duplicate: FileAttribute(this != $fileAttribute, label == $label, value == $value)
$tenantId: TenantContext.getTenantId();
then then
retract($duplicate); retract($duplicate);
System.exit(0); System.exit(0);
@ -395,6 +401,8 @@ class DroolsValidationServiceTest {
.forEach(System.out::println); .forEach(System.out::println);
assertFalse(droolsValidation.isCompiled()); assertFalse(droolsValidation.isCompiled());
assertEquals(droolsValidation.getBlacklistErrorMessages().size(), 1); assertEquals(droolsValidation.getBlacklistErrorMessages().size(), 1);
assertEquals(droolsValidation.getBlacklistErrorMessages().get(0).getBlacklistedKeywords().size(), 2);
assertTrue(droolsValidation.getBlacklistErrorMessages().get(0).getBlacklistedKeywords().contains("TenantContext"));
} }
} }