The_Great_Archive/dufs
1
0
Fork 0
mirror of https://github.com/sigoden/dufs.git synced 2026-09-14 11:06:17 +05:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: escape control chars in logged URI and headers (#691)

Browse Source
This commit is contained in:
sigoden 2026-04-25 18:51:21 +08:00 committed by GitHub
parent 19dc2c205a
commit 1af66d6744
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/http_logger.rs
View File

@ -30,7 +30,9 @@ impl HttpLogger {
LogElement::Variable(name) => match name.as_str() {
"request" => {
let uri = req.uri().to_string();
let uri = decode_uri(&uri).map(|s| s.to_string()).unwrap_or(uri);
let uri = decode_uri(&uri)
.map(|s| sanitize_log_value(&s))
.unwrap_or(uri);
data.insert(name.to_string(), format!("{} {uri}", req.method()));
}
"remote_user" => {
@ -44,7 +46,7 @@ impl HttpLogger {
},
LogElement::Header(name) => {
if let Some(value) = req.headers().get(name).and_then(|v| v.to_str().ok()) {
data.insert(name.to_string(), value.to_string());
data.insert(name.to_string(), sanitize_log_value(value));
}
}
LogElement::Literal(_) => {}
@ -104,3 +106,15 @@ impl FromStr for HttpLogger {
Ok(Self { elements })
}
}
fn sanitize_log_value(s: &str) -> String {
s.chars()
.flat_map(|c| {
if c.is_control() {
format!("\\x{:02x}", c as u32).chars().collect::<Vec<_>>()
} else {
vec![c]
}
})
.collect()
}