allthingssecurity commented on code in PR #27036:
URL: https://github.com/apache/camel/pull/27036#discussion_r4130958505
##########
components/camel-syslog/src/main/java/org/apache/camel/component/syslog/SyslogConverter.java:
##########
@@ -224,32 +227,47 @@ public static SyslogMessage parseMessage(byte[] bytes) {
if (isRfc5424) {
Rfc5424SyslogMessage rfc5424SyslogMessage = (Rfc5424SyslogMessage)
syslogMessage;
StringBuilder appName = new StringBuilder();
- while ((charFound = (char) (byteBuffer.get() & 0xff)) != ' ') {
+ while (byteBuffer.hasRemaining() && (charFound = (char)
(byteBuffer.get() & 0xff)) != ' ') {
appName.append(charFound);
}
rfc5424SyslogMessage.setAppName(appName.toString());
StringBuilder procId = new StringBuilder();
- while ((charFound = (char) (byteBuffer.get() & 0xff)) != ' ') {
+ while (byteBuffer.hasRemaining() && (charFound = (char)
(byteBuffer.get() & 0xff)) != ' ') {
procId.append(charFound);
}
rfc5424SyslogMessage.setProcId(procId.toString());
StringBuilder msgId = new StringBuilder();
- while ((charFound = (char) (byteBuffer.get() & 0xff)) != ' ') {
+ while (byteBuffer.hasRemaining() && (charFound = (char)
(byteBuffer.get() & 0xff)) != ' ') {
msgId.append(charFound);
}
rfc5424SyslogMessage.setMsgId(msgId.toString());
+ // STRUCTURED-DATA is the NILVALUE or SD-ELEMENTs (RFC 5424 6.3).
A PARAM-VALUE is quoted, and escapes
+ // '"', '\' and ']' with a backslash, so a ']' only closes the
element outside a PARAM-VALUE
StringBuilder structuredData = new StringBuilder();
boolean inblock = false;
- while ((charFound = (char) (byteBuffer.get() & 0xff)) != ' ' ||
inblock) {
- if (charFound == '[') {
+ boolean inValue = false;
+ boolean escaped = false;
+ char previous = 0;
+ while (byteBuffer.hasRemaining() && ((charFound = (char)
(byteBuffer.get() & 0xff)) != ' ' || inblock)) {
+ if (inValue) {
+ if (escaped) {
+ escaped = false;
+ } else if (charFound == '\\') {
+ escaped = true;
+ } else if (charFound == '"') {
+ inValue = false;
+ }
+ } else if (charFound == '[') {
inblock = true;
- }
- if (charFound == ']') {
+ } else if (charFound == ']') {
inblock = false;
+ } else if (charFound == '"' && inblock && previous == '=') {
+ inValue = true;
Review Comment:
Added `testUnterminatedParamValue` in d056330da: for `[exampleSDID@32473
note="x] hello`, the rest of the message is the structured data and MSG is
empty, with a comment that this is invalid input and how it differs from
before. camel-syslog passes (23 tests).
_Claude Code on behalf of allthingssecurity_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
