Skip to content

Commit a17c6b4

Browse files
Tobianasihrasko
authored andcommitted
Logging should not be vulnerable to injection attacks
This issue was detected by sonarcloud. Resolve it by sanitising the LOG message using StringEscapeUtils. JIRA: LIGHTY-362 Signed-off-by: tobias.pobocik <[email protected]>
1 parent fcccabe commit a17c6b4

File tree

1 file changed

+3
-2
lines changed
  • lighty-examples/lighty-controller-springboot-netconf/src/main/java/io/lighty/core/controller/springboot/rest

1 file changed

+3
-2
lines changed

lighty-examples/lighty-controller-springboot-netconf/src/main/java/io/lighty/core/controller/springboot/rest/TopologyRestService.java

+3-2
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
package io.lighty.core.controller.springboot.rest;
1010

1111
import io.lighty.core.controller.springboot.utils.Utils;
12+
import org.apache.commons.text.StringEscapeUtils;
1213
import org.opendaylight.mdsal.binding.api.DataBroker;
1314
import org.opendaylight.mdsal.binding.api.ReadTransaction;
1415
import org.opendaylight.mdsal.binding.api.WriteTransaction;
@@ -116,10 +117,10 @@ public ResponseEntity deleteTopologyOperational(@PathVariable final String topol
116117

117118
try {
118119
tx.commit().get(TIMEOUT, TimeUnit.SECONDS);
119-
LOG.info("Topology {} was deleted from datastore", topologyId);
120+
LOG.info("Topology {} was deleted from datastore", StringEscapeUtils.escapeJava(topologyId));
120121
return ResponseEntity.ok().build();
121122
} catch (ExecutionException | TimeoutException e) {
122-
LOG.error("Could not delete topology {} from datastore", topologyId, e);
123+
LOG.error("Could not delete topology {} from datastore", StringEscapeUtils.escapeJava(topologyId), e);
123124
return ResponseEntity.status(500).build();
124125
}
125126
}

0 commit comments

Comments
 (0)