feat: migrating report generator on Java scheduled job #16
Conversation
|
This pull request does not contain a valid label. Please add one of the following labels: |
|
The default action is to increase the PATCH number of SEMVER. Set IGNORE-FOR-RELEASE if you want to skip SEMVER bump. BREAKING-CHANGE and NEW-RELEASE must be run from GH Actions section manually. |
|
The default action is to increase the |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| public void generateDailyReport(String day) { | ||
|
|
||
| log.info("[Report Generation][Start] Started report generation for {}.", day); |
Check failure
Code scanning / CodeQL
Log Injection High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 days ago
To fix the log injection issue, we need to sanitize the day parameter before using it in log messages. Specifically, we should remove any new-line characters and other potentially harmful characters from the day parameter. This can be done using the replaceAll method to replace any non-alphanumeric characters with an empty string.
The best way to fix the problem without changing existing functionality is to sanitize the day parameter in the generateDailyReport, generateWeeklyReport, and generateMonthlyReport methods before logging it. This ensures that any potentially harmful characters are removed before the parameter is used in log messages.
| @@ -118,3 +118,3 @@ | ||
| public void generateDailyReport(String day) { | ||
|
|
||
| day = day.replaceAll("[^\\w-]", ""); | ||
| log.info("[Report Generation][Start] Started report generation for {}.", day); | ||
| @@ -200,3 +200,3 @@ | ||
| public void generateWeeklyReport(String dayOfThisWeek) { | ||
|
|
||
| dayOfThisWeek = dayOfThisWeek.replaceAll("[^\\w-]", ""); | ||
| log.info("[Report Generation][Start] Started weekly report generation for week previous than day {}.", dayOfThisWeek); | ||
| @@ -208,3 +208,3 @@ | ||
| public void generateMonthlyReport(String dayOfThisMonth) { | ||
|
|
||
| dayOfThisMonth = dayOfThisMonth.replaceAll("[^\\w-]", ""); | ||
| log.info("[Report Generation][Start] Started monthly report generation for month previous than day {}.", dayOfThisMonth); |
| pairs.forEach((sessionId, businessProcess) -> rptStats.addNotCompletedTriggeredPrimitives(businessProcess.replace("-", "_"))); | ||
|
|
||
| reportRepository.save(reportMapper.toEntity(rptStats)); | ||
| log.info("[Report Generation][End ] Ended report generation for {}.", day); |
Check failure
Code scanning / CodeQL
Log Injection High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 days ago
To fix the log injection issue, we need to sanitize the day parameter before logging it. Since the day parameter is expected to be a date in the format yyyy-MM-dd, we can validate it using a regular expression to ensure it matches the expected format. This will prevent any malicious input from being logged.
- Add a method to validate the
dayparameter using a regular expression. - Use this method to validate the
dayparameter before logging it in thegenerateDailyReport,generateWeeklyReport, andgenerateMonthlyReportmethods.
| @@ -25,2 +25,6 @@ | ||
| @Slf4j | ||
|
|
||
| private boolean isValidDate(String date) { | ||
| return date != null && date.matches("\\d{4}-\\d{2}-\\d{2}"); | ||
| } | ||
| @RequiredArgsConstructor | ||
| @@ -119,2 +123,6 @@ | ||
|
|
||
| if (!isValidDate(day)) { | ||
| log.warn("[Report Generation][Start] Invalid date format for day: {}", day); | ||
| return; | ||
| } | ||
| log.info("[Report Generation][Start] Started report generation for {}.", day); | ||
| @@ -201,2 +209,6 @@ | ||
|
|
||
| if (!isValidDate(dayOfThisWeek)) { | ||
| log.warn("[Report Generation][Start] Invalid date format for day: {}", dayOfThisWeek); | ||
| return; | ||
| } | ||
| log.info("[Report Generation][Start] Started weekly report generation for week previous than day {}.", dayOfThisWeek); | ||
| @@ -209,2 +221,6 @@ | ||
|
|
||
| if (!isValidDate(dayOfThisMonth)) { | ||
| log.warn("[Report Generation][Start] Invalid date format for day: {}", dayOfThisMonth); | ||
| return; | ||
| } | ||
| log.info("[Report Generation][Start] Started monthly report generation for month previous than day {}.", dayOfThisMonth); |
|
|
||
| public void generateWeeklyReport(String dayOfThisWeek) { | ||
|
|
||
| log.info("[Report Generation][Start] Started weekly report generation for week previous than day {}.", dayOfThisWeek); |
Check failure
Code scanning / CodeQL
Log Injection High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 days ago
To fix the log injection issue, we need to sanitize the user input before logging it. Specifically, we should remove any newline characters from the dayOfThisWeek parameter to prevent log forging. Additionally, we should ensure that the input is clearly marked in the log entry to avoid confusion.
The best way to fix this problem is to use the String.replace method to remove newline characters from the dayOfThisWeek parameter before logging it. This can be done in the generateWeeklyReport method of the ReportGenerationService class.
| @@ -201,6 +201,7 @@ | ||
|
|
||
| log.info("[Report Generation][Start] Started weekly report generation for week previous than day {}.", dayOfThisWeek); | ||
| String yesterday = CommonUtility.getYesterday(dayOfThisWeek); | ||
| String sanitizedDayOfThisWeek = dayOfThisWeek.replace("\n", "").replace("\r", ""); | ||
| log.info("[Report Generation][Start] Started weekly report generation for week previous than day {}.", sanitizedDayOfThisWeek); | ||
| String yesterday = CommonUtility.getYesterday(sanitizedDayOfThisWeek); | ||
| mergeMultipleReports(CommonUtility.getWeekInDate(yesterday), ReportType.WEEKLY); | ||
| log.info("[Report Generation][End ] Ended monthly report generation for week that includes day {}.", dayOfThisWeek); | ||
| log.info("[Report Generation][End ] Ended monthly report generation for week that includes day {}.", sanitizedDayOfThisWeek); | ||
| } |
| log.info("[Report Generation][Start] Started weekly report generation for week previous than day {}.", dayOfThisWeek); | ||
| String yesterday = CommonUtility.getYesterday(dayOfThisWeek); | ||
| mergeMultipleReports(CommonUtility.getWeekInDate(yesterday), ReportType.WEEKLY); | ||
| log.info("[Report Generation][End ] Ended monthly report generation for week that includes day {}.", dayOfThisWeek); |
Check failure
Code scanning / CodeQL
Log Injection High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 days ago
To fix the log injection issue, we need to sanitize the user-provided input before logging it. Specifically, we should remove any newline characters or other potentially harmful characters from the input. This can be done using the String.replace method to replace newline characters with an empty string. Additionally, we should ensure that the input is clearly marked in the log entries to prevent any confusion.
| @@ -196,3 +196,4 @@ | ||
| reportRepository.save(reportMapper.toEntity(rptStats)); | ||
| log.info("[Report Generation][End ] Ended report generation for {}.", day); | ||
| String sanitizedDay = day.replace("\n", "").replace("\r", ""); | ||
| log.info("[Report Generation][End ] Ended report generation for {}.", sanitizedDay); | ||
| } | ||
| @@ -201,6 +202,7 @@ | ||
|
|
||
| log.info("[Report Generation][Start] Started weekly report generation for week previous than day {}.", dayOfThisWeek); | ||
| String yesterday = CommonUtility.getYesterday(dayOfThisWeek); | ||
| String sanitizedDayOfThisWeek = dayOfThisWeek.replace("\n", "").replace("\r", ""); | ||
| log.info("[Report Generation][Start] Started weekly report generation for week previous than day {}.", sanitizedDayOfThisWeek); | ||
| String yesterday = CommonUtility.getYesterday(sanitizedDayOfThisWeek); | ||
| mergeMultipleReports(CommonUtility.getWeekInDate(yesterday), ReportType.WEEKLY); | ||
| log.info("[Report Generation][End ] Ended monthly report generation for week that includes day {}.", dayOfThisWeek); | ||
| log.info("[Report Generation][End ] Ended monthly report generation for week that includes day {}.", sanitizedDayOfThisWeek); | ||
| } | ||
| @@ -209,6 +211,7 @@ | ||
|
|
||
| log.info("[Report Generation][Start] Started monthly report generation for month previous than day {}.", dayOfThisMonth); | ||
| String yesterday = CommonUtility.getYesterday(dayOfThisMonth); | ||
| String sanitizedDayOfThisMonth = dayOfThisMonth.replace("\n", "").replace("\r", ""); | ||
| log.info("[Report Generation][Start] Started monthly report generation for month previous than day {}.", sanitizedDayOfThisMonth); | ||
| String yesterday = CommonUtility.getYesterday(sanitizedDayOfThisMonth); | ||
| mergeMultipleReports(CommonUtility.getMonthInDate(yesterday), ReportType.MONTHLY); | ||
| log.info("[Report Generation][End ] Ended monthly report generation for month that includes day {}.", dayOfThisMonth); | ||
| log.info("[Report Generation][End ] Ended monthly report generation for month that includes day {}.", sanitizedDayOfThisMonth); | ||
| } |
|
|
||
| public void generateMonthlyReport(String dayOfThisMonth) { | ||
|
|
||
| log.info("[Report Generation][Start] Started monthly report generation for month previous than day {}.", dayOfThisMonth); |
Check failure
Code scanning / CodeQL
Log Injection High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 days ago
To fix the log injection issue, we need to sanitize the user input before logging it. Specifically, we should remove any newline characters from the user input to prevent log forgery. Additionally, we should ensure that the input conforms to the expected date format.
The best way to fix this problem is to sanitize the dayOfThisMonth parameter in the generateMonthlyReport method of the ReportGenerationService class. We can use the replace method to remove any newline characters from the input.
| @@ -209,6 +209,7 @@ | ||
|
|
||
| log.info("[Report Generation][Start] Started monthly report generation for month previous than day {}.", dayOfThisMonth); | ||
| String yesterday = CommonUtility.getYesterday(dayOfThisMonth); | ||
| String sanitizedDay = dayOfThisMonth.replace("\n", "").replace("\r", ""); | ||
| log.info("[Report Generation][Start] Started monthly report generation for month previous than day {}.", sanitizedDay); | ||
| String yesterday = CommonUtility.getYesterday(sanitizedDay); | ||
| mergeMultipleReports(CommonUtility.getMonthInDate(yesterday), ReportType.MONTHLY); | ||
| log.info("[Report Generation][End ] Ended monthly report generation for month that includes day {}.", dayOfThisMonth); | ||
| log.info("[Report Generation][End ] Ended monthly report generation for month that includes day {}.", sanitizedDay); | ||
| } |
| log.info("[Report Generation][Start] Started monthly report generation for month previous than day {}.", dayOfThisMonth); | ||
| String yesterday = CommonUtility.getYesterday(dayOfThisMonth); | ||
| mergeMultipleReports(CommonUtility.getMonthInDate(yesterday), ReportType.MONTHLY); | ||
| log.info("[Report Generation][End ] Ended monthly report generation for month that includes day {}.", dayOfThisMonth); |
Check failure
Code scanning / CodeQL
Log Injection High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 days ago
To fix the log injection issue, we need to sanitize the user input before logging it. Since the input is expected to be a date, we can ensure it matches the expected date format (yyyy-MM-dd). If the input does not match the expected format, we can log a sanitized version or an error message.
The best way to fix this problem without changing existing functionality is to use a regular expression to validate the date format and replace any invalid characters. We will update the generateMonthlyReport method in the ReportGenerationService class to include this validation and sanitization.
| @@ -209,2 +209,7 @@ | ||
|
|
||
| if (!dayOfThisMonth.matches("\\d{4}-\\d{2}-\\d{2}")) { | ||
| log.warn("[Report Generation][Start] Invalid date format for day: {}. Expected format: yyyy-MM-dd", dayOfThisMonth.replaceAll("[\r\n]", "")); | ||
| return; | ||
| } | ||
|
|
||
| log.info("[Report Generation][Start] Started monthly report generation for month previous than day {}.", dayOfThisMonth); |
…-generator' into feat-migrate-report-generator
…-generator' into feat-migrate-report-generator
|
This PR exceeds the recommended size of 400 lines. Please make sure you are NOT addressing multiple issues with one PR. Note this PR might be rejected due to its size. |
|
Comment this PR with update_code to format the code. Consider to use pre-commit to format the code. |
List of Changes
Motivation and Context
How Has This Been Tested?
Screenshots (if appropriate):
Types of changes
Checklist: