jan/openreplay
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(backend): added extra checks for urlMethod and resourceType in CH connector (#717)

Browse source
This commit is contained in:
Alexander 2022-09-02 22:31:57 +02:00 • committed by GitHub
parent d3b0934271
commit 9c4492b093
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 18 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
backend/pkg/url/method.go
View file

@ -1,6 +1,7 @@
package url
var METHODS = []string{"GET", "HEAD", "POST", "PUT", "DELETE", "CONNECT", "OPTIONS", "TRACE", "PATCH"}
var TYPES = []string{"other", "script", "stylesheet", "fetch", "img", "media"}
func EnsureMethod(method string) string {
for _, m := range METHODS {
@ -10,3 +11,12 @@ func EnsureMethod(method string) string {
}
return ""
}
func EnsureType(tp string) string {
for _, t := range TYPES {
if t == tp {
return tp
}
}
return ""
}

8
ee/backend/pkg/db/clickhouse/connector.go
View file

@ -217,6 +217,10 @@ func (c *connectorImpl) InsertWebResourceEvent(session *types.Session, msg *mess
if method == "" {
method = nil
}
resourceType := url.EnsureType(msg.Type)
if resourceType == "" {
return fmt.Errorf("can't parse resource type, sess: %s, type: %s", session.SessionID, msg.Type)
}
if err := c.batches["resources"].Append(
session.SessionID,
uint16(session.ProjectID),
@ -363,6 +367,10 @@ func (c *connectorImpl) InsertAutocomplete(session *types.Session, msgType, msgV
}
func (c *connectorImpl) InsertRequest(session *types.Session, msg *messages.FetchEvent, savePayload bool) error {
urlMethod := url.EnsureMethod(msg.Method)
if urlMethod == "" {
return fmt.Errorf("can't parse http method. sess: %d, method: %s", session.SessionID, msg.Method)
}
var request, response *string
if savePayload {
request = &msg.Request