mirror of
https://github.com/wekan/wekan.git
synced 2026-11-07 02:52:33 -05:00
Lauri Ojansivu
1d82ef8eae
Per correction: use only the existing WeKan database via Meteor JavaScript
queries (works on FerretDB and MongoDB); do not create files/DBs under
WRITABLE_PATH; and have FerretDB report problems to WeKan rather than writing
itself.
- models/eventLog.js: one `eventlog` collection (stream: security|speed|tests).
- server/lib/{securityLog,speedLog,testLog}.js: thin wrappers that insert one
document via EventLog.insertAsync (fire-and-forget, never throw).
- models/lib/securityLogFormat.js slimmed to just sanitizeDetail; remove the
node:sqlite event store (server/lib/eventStore.js) and all file/path/schema
helpers.
- Add a Tests stream: log anything that would fail an existing WeKan test.
- Design docs (WeKan.md, FerretDB.md) rewritten: DB-collection storage, grouped
counts for the summary, Admin Reports read the collection, and FerretDB reports
problems to WeKan which records them (no FerretDB DB/file writes).
- tests/securityLog.test.cjs updated (sanitizer + catalog + collection wiring +
no-filesystem guards); verified via Python mirror.
22 lines
938 B
JavaScript
22 lines
938 B
JavaScript
'use strict';
|
|
|
|
// Detail sanitizer for the event log (design: docs/Security/Remediation/WeKan.md §4).
|
|
// Events are stored as documents in the existing WeKan database (models/eventLog.js)
|
|
// via normal Meteor JavaScript queries, so there are no file/path/schema helpers
|
|
// here — only the pure, unit-testable text sanitizer. CommonJS so tests/*.test.cjs
|
|
// can load it.
|
|
|
|
const MAX_DETAIL = 500;
|
|
|
|
// Collapse to one line, strip ASCII control chars (incl. newlines/tabs/DEL), and
|
|
// cap length — a hostile/huge detail can never bloat a row, and since it is stored
|
|
// via a Meteor collection insert it is a bound value, never concatenated into a query.
|
|
function sanitizeDetail(s) {
|
|
if (s == null) return '';
|
|
let out = String(s).replace(/[\x00-\x1f\x7f]+/g, ' ').replace(/\s+/g, ' ').trim();
|
|
if (out.length > MAX_DETAIL) out = out.slice(0, MAX_DETAIL - 1) + '…';
|
|
return out;
|
|
}
|
|
|
|
module.exports = { MAX_DETAIL, sanitizeDetail };
|