@adobe/spacecat-shared-data-access 4.14.0 → 4.15.1

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [@adobe/spacecat-shared-data-access-v4.15.1](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-data-access-v4.15.0...@adobe/spacecat-shared-data-access-v4.15.1) (2026-07-29)
+
+### Bug Fixes
+
+* validate cdnlogsFilter key against a column allowlist in site config ([#1851](https://github.com/adobe/spacecat-shared/issues/1851)) ([46a0408](https://github.com/adobe/spacecat-shared/commit/46a0408b852fa6f6483fc2ad81c3ce1a8d0c615d)), closes [adobe/spacecat-audit-worker#2826](https://github.com/adobe/spacecat-audit-worker/issues/2826)
+
+## [@adobe/spacecat-shared-data-access-v4.15.0](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-data-access-v4.14.0...@adobe/spacecat-shared-data-access-v4.15.0) (2026-07-29)
+
+### Features
+
+* **site-config:** add showWww flag to llmo config ([#1850](https://github.com/adobe/spacecat-shared/issues/1850)) ([e87b454](https://github.com/adobe/spacecat-shared/commit/e87b45481d2b34cdb9f86e569f7598dea967ed6e))
+
 ## [@adobe/spacecat-shared-data-access-v4.14.0](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-data-access-v4.13.0...@adobe/spacecat-shared-data-access-v4.14.0) (2026-07-27)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/spacecat-shared-data-access",
-  "version": "4.14.0",
+  "version": "4.15.1",
   "description": "Shared modules of the Spacecat Services - Data Access",
   "type": "module",
   "engines": {

package/src/models/site/config.js

@@ -70,6 +70,30 @@ const RESERVED_SCRAPER_HEADER_NAMES = new Set([
 
 const LLMO_TAG_PATTERN = /^(market|product|topic):\s?.+/;
 const AWS_REGION_PATTERN = /^[a-z]{2}(?:-[a-z]+)+-\d+$/i;
+
+// Columns on the CDN log tables that a cdnlogsFilter entry is allowed to target.
+// `key` is interpolated (unquoted) into Athena SQL by the audit worker's
+// buildSiteFilters(), so it MUST be constrained to this allowlist to prevent SQL
+// injection (VULN-37491). Keep in sync with ALLOWED_FILTER_KEYS in
+// spacecat-audit-worker/src/utils/cdn-utils.js.
+export const CDN_LOGS_FILTER_KEYS = [
+  'url',
+  'host',
+  'x_forwarded_host',
+  'user_agent',
+  'referer',
+  'cdn_provider',
+];
+
+const CDN_LOGS_FILTER_SCHEMA = Joi.array().items(
+  Joi.object({
+    // Athena folds column identifiers to lowercase; normalize before matching
+    // the allowlist so a stored 'X_forwarded_host' is accepted as the same column.
+    key: Joi.string().lowercase().valid(...CDN_LOGS_FILTER_KEYS).required(),
+    value: Joi.array().items(Joi.string()).required(),
+    type: Joi.string().valid('include', 'exclude').optional(),
+  }),
+);
 const LLMO_TAG = Joi.alternatives()
   .try(
     // Tag market, product, topic like this: "market: ch", "product: firefly", "topic: copyright"
@@ -351,13 +375,7 @@ export const configSchema = Joi.object({
       }),
     ).optional(),
     tags: Joi.array().items(Joi.string()).optional(),
-    cdnlogsFilter: Joi.array().items(
-      Joi.object({
-        key: Joi.string().required(),
-        value: Joi.array().items(Joi.string()).required(),
-        type: Joi.string().valid('include', 'exclude').optional(),
-      }),
-    ).optional(),
+    cdnlogsFilter: CDN_LOGS_FILTER_SCHEMA.optional(),
     countryCodeIgnoreList: Joi.array().items(
       Joi.string().length(2),
     ).optional(),
@@ -389,6 +407,7 @@ export const configSchema = Joi.object({
       'ams-frontdoor',
       'other',
     ).optional(),
+    showWww: Joi.boolean().optional(),
   }).optional(),
   cdnLogsConfig: Joi.object({
     bucketName: Joi.string().required(),
@@ -721,6 +740,11 @@ export const Config = (data = {}) => {
     state.llmo.brand = brand;
   };
 
+  self.updateLlmoShowWww = (showWww) => {
+    state.llmo = state.llmo || {};
+    state.llmo.showWww = showWww;
+  };
+
   self.addLlmoHumanQuestions = (questions) => {
     state.llmo = state.llmo || {};
     state.llmo.questions = state.llmo.questions || {};
@@ -836,8 +860,17 @@ export const Config = (data = {}) => {
   };
 
   self.updateLlmoCdnlogsFilter = (cdnlogsFilter) => {
+    // Reject invalid filter keys at write time (VULN-37491): `key` is
+    // interpolated into Athena SQL downstream, so anything off the allowlist
+    // must never be persisted. Validate only the filter here to avoid coupling
+    // to unrelated required fields elsewhere in the config.
+    const { error, value } = CDN_LOGS_FILTER_SCHEMA.validate(cdnlogsFilter);
+    if (error) {
+      throw new Error(`CDN logs filter validation error: ${error.message}`, { cause: error });
+    }
+
     state.llmo = state.llmo || {};
-    state.llmo.cdnlogsFilter = cdnlogsFilter;
+    state.llmo.cdnlogsFilter = value;
   };
 
   self.updateLlmoCountryCodeIgnoreList = (countryCodeIgnoreList) => {