Merge pull request #7385 from ViacheslavKlimov/fix/audit-log-validation

[3.4.2] Additional validation for AuditLog entities

common/data/src/main/java/org/thingsboard/server/common/data/audit/AuditLog.java

@@ -22,6 +22,7 @@ import lombok.Data;
 import lombok.EqualsAndHashCode;
 import org.thingsboard.server.common.data.BaseData;
 import org.thingsboard.server.common.data.id.*;
+import org.thingsboard.server.common.data.validation.NoXss;
 
 @ApiModel
 @EqualsAndHashCode(callSuper = true)
@@ -34,6 +35,7 @@ public class AuditLog extends BaseData<AuditLogId> {
     private CustomerId customerId;
     @ApiModelProperty(position = 5, value = "JSON object with Entity id", accessMode = ApiModelProperty.AccessMode.READ_ONLY)
     private EntityId entityId;
+    @NoXss
     @ApiModelProperty(position = 6, value = "Name of the logged entity", example = "Thermometer", accessMode = ApiModelProperty.AccessMode.READ_ONLY)
     private String entityName;
     @ApiModelProperty(position = 7, value = "JSON object with User id.", accessMode = ApiModelProperty.AccessMode.READ_ONLY)

dao/src/main/java/org/thingsboard/server/dao/audit/AuditLogServiceImpl.java

@@ -23,13 +23,13 @@ import com.google.common.collect.Lists;
 import com.google.common.util.concurrent.Futures;
 import com.google.common.util.concurrent.ListenableFuture;
 import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.stereotype.Service;
 import org.thingsboard.common.util.JacksonUtil;
 import org.thingsboard.server.common.data.EntityType;
 import org.thingsboard.server.common.data.HasName;
-import org.thingsboard.server.common.data.StringUtils;
 import org.thingsboard.server.common.data.audit.ActionStatus;
 import org.thingsboard.server.common.data.audit.ActionType;
 import org.thingsboard.server.common.data.audit.AuditLog;
@@ -382,7 +382,15 @@ public class AuditLogServiceImpl implements AuditLogService {
         AuditLog auditLogEntry = createAuditLogEntry(tenantId, entityId, entityName, customerId, userId, userName,
                 actionType, actionData, actionStatus, actionFailureDetails);
         log.trace("Executing logAction [{}]", auditLogEntry);
-        auditLogValidator.validate(auditLogEntry, AuditLog::getTenantId);
+        try {
+            auditLogValidator.validate(auditLogEntry, AuditLog::getTenantId);
+        } catch (Exception e) {
+            if (StringUtils.contains(e.getMessage(), "value is malformed")) {
+                auditLogEntry.setEntityName("MALFORMED");
+            } else {
+                return Futures.immediateFailedFuture(e);
+            }
+        }
         List<ListenableFuture<Void>> futures = Lists.newArrayListWithExpectedSize(INSERTS_PER_ENTRY);
         futures.add(auditLogDao.saveByTenantId(auditLogEntry));
 

dao/src/main/java/org/thingsboard/server/dao/service/DataValidator.java

@@ -62,7 +62,7 @@ public abstract class DataValidator<D extends BaseData<?>> {
             }
             return old;
         } catch (DataValidationException e) {
-            log.error("Data object is invalid: [{}]", e.getMessage());
+            log.error("{} object is invalid: [{}]", data == null ? "Data" : data.getClass().getSimpleName(), e.getMessage());
             throw e;
         }
     }

dao/src/test/java/org/thingsboard/server/dao/service/NoXssValidatorTest.java

@@ -42,7 +42,7 @@ public class NoXssValidatorTest {
             "<p><a href=\"http://htmlbook.ru/example/knob.html\">Link!!!</a></p>1221",
             "<h3>Please log in to proceed</h3> <form action=http://192.168.149.128>Username:<br><input type=\"username\" name=\"username\"></br>Password:<br><input type=\"password\" name=\"password\"></br><br><input type=\"submit\" value=\"Log in\"></br>",
             "   <img src= \"http://site.com/\"  >  ",
-            "123 <input type=text value=a onfocus=alert(1337) AUTOFOCUS>bebe",
+            "123 <input type=text value=a onfocus=alert(1337) AUTOFOCUS>bebe"
     })
     public void testIsNotValid(String stringWithXss) {
         boolean isValid = validator.isValid(stringWithXss, mock(ConstraintValidatorContext.class));