Marmelator/redaction-service
1
0
Fork 0
Code Issues Pull Requests 14 Actions Packages Projects Releases 622 Wiki Activity

RED-9016: Leaks regarding the blacklist: Keyword protection insufficient

Browse Source
This commit is contained in:
Maverick Studer 2024-05-22 10:58:16 +02:00
parent 6418fb1365
commit d431d31a66
2 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
redaction-service-v1/redaction-service-server-v1/src/main/java/com/iqser/red/service/redaction/v1/server/service/drools/DroolsValidationService.java
View File

@ -9,6 +9,7 @@ import java.util.regex.Pattern;
import java.util.stream.Collectors;
import java.util.stream.Stream;
import org.apache.commons.lang3.StringUtils;
import org.drools.drl.parser.DroolsParserException;
import org.kie.api.builder.KieBuilder;
import org.kie.api.builder.Message;
@ -232,11 +233,12 @@ public class DroolsValidationService {
for (RuleClass ruleClass : ruleFileBluePrint.getRuleClasses()) {
for (RuleUnit ruleUnit : ruleClass.ruleUnits()) {
for (BasicRule basicRule : ruleUnit.rules()) {
List<SearchImplementation.MatchPosition> matches = blacklistedKeywordSearchImplementation.getMatches(basicRule.getCode());
String sanitizedRuleText = StringUtils.deleteWhitespace(basicRule.getCode());
List<SearchImplementation.MatchPosition> matches = blacklistedKeywordSearchImplementation.getMatches(sanitizedRuleText);
if (!matches.isEmpty()) {
List<String> foundBlacklistedKeywords = matches.stream()
.map(m -> basicRule.getCode().substring(m.startIndex(), m.endIndex()))
.map(m -> sanitizedRuleText.substring(m.startIndex(), m.endIndex()))
.distinct()
.toList();
blacklistErrorMessages.add(DroolsBlacklistErrorMessage.builder()

7
redaction-service-v1/redaction-service-server-v1/src/main/resources/drools/blacklist.txt
View File

@ -1,11 +1,12 @@
System.
Runtime.
Thread.
ProcessBuilder.
SecurityManager.
ClassLoader.
Class.
ProcessBuilder
SecurityManager
ClassLoader
java.io.File
java.nio.file
java.io.Object