fluent / fluent-plugin-opensearch / 37575507139

93%

main: 93%

Build Type

Pull #192

github

Committed by kenhys

Commit Message

out_opensearch: limit what a host placeholder can expand to

Before: a placeholder in `host`/`hosts` was expanded as is, so a tag or
a record field could add a host with ",", userinfo with "@" or a path
with "/", move the request to another domain, or drop the host with an
empty value. The configured user, password and custom_headers were then
sent to that host.

After: each value is checked before the setting is expanded, so it can
only fill in the part of a host name that the placeholder stands for:
one label, a sub domain of a domain that the operator fixed with two or
more names, or a whole host name with a port. An IPv6 address is allowed
where the operator wrote the "[]" or the scheme that `URI()` needs. A
placeholder used with credentials also logs a warning at startup, and
the README asks for a fixed domain that the operator controls, because
two fixed names alone do not make a destination trusted.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kentaro Hayashi <hayashi@clear-code.com>

Pull Request Pull Request #192: out_opensearch: limit what a host placeholder can expand to

Coverage Stats

47 of 47 new or added lines in 2 files covered. (100.0%)

51 existing lines in 2 files now uncovered.

1245 of 1337 relevant lines covered (93.12%)

330.75 hits per line