Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HttpUtility::SendJsonBody(): auto-sanitize non-UTF-8 JSON #6809

Closed
wants to merge 1 commit into from
Closed

HttpUtility::SendJsonBody(): auto-sanitize non-UTF-8 JSON #6809

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 44 additions & 16 deletions lib/base/json.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@
#include "base/array.hpp"
#include "base/objectlock.hpp"
#include "base/convert.hpp"
#include "base/utility.hpp"
#include <boost/exception_ptr.hpp>
#include <yajl/yajl_version.h>
#include <yajl/yajl_gen.h>
Expand All @@ -32,53 +33,69 @@

using namespace icinga;

static void Encode(yajl_gen handle, const Value& value);
template<void EncodeString(yajl_gen handle, const String& str)>
static inline void Encode(yajl_gen handle, const Value& value);

#if YAJL_MAJOR < 2
typedef unsigned int yajl_size;
#else /* YAJL_MAJOR */
typedef size_t yajl_size;
#endif /* YAJL_MAJOR */

static void EncodeNamespace(yajl_gen handle, const Namespace::Ptr& ns)
static inline void EncodeString(yajl_gen handle, const String& str)
{
yajl_gen_string(handle, reinterpret_cast<const unsigned char *>(str.CStr()), str.GetLength());
}

static inline void SanitizeString(yajl_gen handle, const String& str)
{
String utf8ed = Utility::ValidateUTF8(str);
yajl_gen_string(handle, reinterpret_cast<const unsigned char *>(utf8ed.CStr()), utf8ed.GetLength());
}

template<void EncodeString(yajl_gen handle, const String& str)>
static inline void EncodeNamespace(yajl_gen handle, const Namespace::Ptr& ns)
{
yajl_gen_map_open(handle);

ObjectLock olock(ns);
for (const Namespace::Pair& kv : ns) {
yajl_gen_string(handle, reinterpret_cast<const unsigned char *>(kv.first.CStr()), kv.first.GetLength());
Encode(handle, kv.second->Get());
EncodeString(handle, kv.first);
Encode<EncodeString>(handle, kv.second->Get());
}

yajl_gen_map_close(handle);
}

static void EncodeDictionary(yajl_gen handle, const Dictionary::Ptr& dict)
template<void EncodeString(yajl_gen handle, const String& str)>
static inline void EncodeDictionary(yajl_gen handle, const Dictionary::Ptr& dict)
{
yajl_gen_map_open(handle);

ObjectLock olock(dict);
for (const Dictionary::Pair& kv : dict) {
yajl_gen_string(handle, reinterpret_cast<const unsigned char *>(kv.first.CStr()), kv.first.GetLength());
Encode(handle, kv.second);
EncodeString(handle, kv.first);
Encode<EncodeString>(handle, kv.second);
}

yajl_gen_map_close(handle);
}

static void EncodeArray(yajl_gen handle, const Array::Ptr& arr)
template<void EncodeString(yajl_gen handle, const String& str)>
static inline void EncodeArray(yajl_gen handle, const Array::Ptr& arr)
{
yajl_gen_array_open(handle);

ObjectLock olock(arr);
for (const Value& value : arr) {
Encode(handle, value);
Encode<EncodeString>(handle, value);
}

yajl_gen_array_close(handle);
}

static void Encode(yajl_gen handle, const Value& value)
template<void EncodeString(yajl_gen handle, const String& str)>
static inline void Encode(yajl_gen handle, const Value& value)
{
switch (value.GetType()) {
case ValueNumber:
Expand All @@ -91,7 +108,7 @@ static void Encode(yajl_gen handle, const Value& value)

break;
case ValueString:
yajl_gen_string(handle, reinterpret_cast<const unsigned char *>(value.Get<String>().CStr()), value.Get<String>().GetLength());
EncodeString(handle, value.Get<String>());

break;
case ValueObject:
Expand All @@ -100,21 +117,21 @@ static void Encode(yajl_gen handle, const Value& value)
Namespace::Ptr ns = dynamic_pointer_cast<Namespace>(obj);

if (ns) {
EncodeNamespace(handle, ns);
EncodeNamespace<EncodeString>(handle, ns);
break;
}

Dictionary::Ptr dict = dynamic_pointer_cast<Dictionary>(obj);

if (dict) {
EncodeDictionary(handle, dict);
EncodeDictionary<EncodeString>(handle, dict);
break;
}

Array::Ptr arr = dynamic_pointer_cast<Array>(obj);

if (arr) {
EncodeArray(handle, arr);
EncodeArray<EncodeString>(handle, arr);
break;
}
}
Expand All @@ -131,7 +148,8 @@ static void Encode(yajl_gen handle, const Value& value)
}
}

String icinga::JsonEncode(const Value& value, bool pretty_print)
template<void EncodeString(yajl_gen handle, const String& str)>
static inline String JsonEncodeBase(const Value& value, bool pretty_print)
{
#if YAJL_MAJOR < 2
yajl_gen_config conf = { pretty_print, "" };
Expand All @@ -142,7 +160,7 @@ String icinga::JsonEncode(const Value& value, bool pretty_print)
yajl_gen_config(handle, yajl_gen_beautify, 1);
#endif /* YAJL_MAJOR */

Encode(handle, value);
Encode<EncodeString>(handle, value);

const unsigned char *buf;
yajl_size len;
Expand All @@ -156,6 +174,16 @@ String icinga::JsonEncode(const Value& value, bool pretty_print)
return result;
}

String icinga::JsonEncode(const Value& value, bool pretty_print)
{
return JsonEncodeBase<EncodeString>(value, pretty_print);
}

String icinga::JsonSanitize(const Value& value, bool pretty_print)
{
return JsonEncodeBase<SanitizeString>(value, pretty_print);
}

struct JsonElement
{
String Key;
Expand Down
1 change: 1 addition & 0 deletions lib/base/json.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ class String;
class Value;

String JsonEncode(const Value& value, bool pretty_print = false);
String JsonSanitize(const Value& value, bool pretty_print = false);
Value JsonDecode(const String& data);

}
Expand Down
2 changes: 1 addition & 1 deletion lib/remote/httputility.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ void HttpUtility::SendJsonBody(HttpResponse& response, const Dictionary::Ptr& pa
if (params)
prettyPrint = GetLastParameter(params, "pretty");

String body = JsonEncode(val, prettyPrint);
String body = JsonSanitize(val, prettyPrint);

response.WriteBody(body.CStr(), body.GetLength());
}
Expand Down