@adobe/spacecat-shared-data-access 4.15.0 → 4.15.2

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [@adobe/spacecat-shared-data-access-v4.15.2](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-data-access-v4.15.1...@adobe/spacecat-shared-data-access-v4.15.2) (2026-07-29)
+
+### Bug Fixes
+
+* **site:** guard config writes against the config schema ([#1852](https://github.com/adobe/spacecat-shared/issues/1852)) ([dafbea2](https://github.com/adobe/spacecat-shared/commit/dafbea2619d1ff65f27b0fe5ca47734b2622619d)), closes [#1850](https://github.com/adobe/spacecat-shared/issues/1850)
+
+## [@adobe/spacecat-shared-data-access-v4.15.1](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-data-access-v4.15.0...@adobe/spacecat-shared-data-access-v4.15.1) (2026-07-29)
+
+### Bug Fixes
+
+* validate cdnlogsFilter key against a column allowlist in site config ([#1851](https://github.com/adobe/spacecat-shared/issues/1851)) ([46a0408](https://github.com/adobe/spacecat-shared/commit/46a0408b852fa6f6483fc2ad81c3ce1a8d0c615d)), closes [adobe/spacecat-audit-worker#2826](https://github.com/adobe/spacecat-audit-worker/issues/2826)
+
 ## [@adobe/spacecat-shared-data-access-v4.15.0](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-data-access-v4.14.0...@adobe/spacecat-shared-data-access-v4.15.0) (2026-07-29)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/spacecat-shared-data-access",
-  "version": "4.15.0",
+  "version": "4.15.2",
   "description": "Shared modules of the Spacecat Services - Data Access",
   "type": "module",
   "engines": {

package/src/models/site/config.js

@@ -70,6 +70,30 @@ const RESERVED_SCRAPER_HEADER_NAMES = new Set([
 
 const LLMO_TAG_PATTERN = /^(market|product|topic):\s?.+/;
 const AWS_REGION_PATTERN = /^[a-z]{2}(?:-[a-z]+)+-\d+$/i;
+
+// Columns on the CDN log tables that a cdnlogsFilter entry is allowed to target.
+// `key` is interpolated (unquoted) into Athena SQL by the audit worker's
+// buildSiteFilters(), so it MUST be constrained to this allowlist to prevent SQL
+// injection (VULN-37491). Keep in sync with ALLOWED_FILTER_KEYS in
+// spacecat-audit-worker/src/utils/cdn-utils.js.
+export const CDN_LOGS_FILTER_KEYS = [
+  'url',
+  'host',
+  'x_forwarded_host',
+  'user_agent',
+  'referer',
+  'cdn_provider',
+];
+
+const CDN_LOGS_FILTER_SCHEMA = Joi.array().items(
+  Joi.object({
+    // Athena folds column identifiers to lowercase; normalize before matching
+    // the allowlist so a stored 'X_forwarded_host' is accepted as the same column.
+    key: Joi.string().lowercase().valid(...CDN_LOGS_FILTER_KEYS).required(),
+    value: Joi.array().items(Joi.string()).required(),
+    type: Joi.string().valid('include', 'exclude').optional(),
+  }),
+);
 const LLMO_TAG = Joi.alternatives()
   .try(
     // Tag market, product, topic like this: "market: ch", "product: firefly", "topic: copyright"
@@ -351,13 +375,7 @@ export const configSchema = Joi.object({
       }),
     ).optional(),
     tags: Joi.array().items(Joi.string()).optional(),
-    cdnlogsFilter: Joi.array().items(
-      Joi.object({
-        key: Joi.string().required(),
-        value: Joi.array().items(Joi.string()).required(),
-        type: Joi.string().valid('include', 'exclude').optional(),
-      }),
-    ).optional(),
+    cdnlogsFilter: CDN_LOGS_FILTER_SCHEMA.optional(),
     countryCodeIgnoreList: Joi.array().items(
       Joi.string().length(2),
     ).optional(),
@@ -842,8 +860,17 @@ export const Config = (data = {}) => {
   };
 
   self.updateLlmoCdnlogsFilter = (cdnlogsFilter) => {
+    // Reject invalid filter keys at write time (VULN-37491): `key` is
+    // interpolated into Athena SQL downstream, so anything off the allowlist
+    // must never be persisted. Validate only the filter here to avoid coupling
+    // to unrelated required fields elsewhere in the config.
+    const { error, value } = CDN_LOGS_FILTER_SCHEMA.validate(cdnlogsFilter);
+    if (error) {
+      throw new Error(`CDN logs filter validation error: ${error.message}`, { cause: error });
+    }
+
     state.llmo = state.llmo || {};
-    state.llmo.cdnlogsFilter = cdnlogsFilter;
+    state.llmo.cdnlogsFilter = value;
   };
 
   self.updateLlmoCountryCodeIgnoreList = (countryCodeIgnoreList) => {

package/src/models/site/site.model.js

@@ -18,6 +18,8 @@ import {
   AUTHORING_TYPES,
 } from '@adobe/spacecat-shared-utils';
 import BaseModel from '../base/base.model.js';
+import { validateConfiguration } from './config.js';
+import { guardConfigValidation } from '../../util/config-validation-guard.js';
 
 const HLX_HOST = /\.(?:aem|hlx)\.(?:page|live)$/i;
 export const AEM_CS_HOST = /^author-p(\d+)-e(\d+)/i;
@@ -84,6 +86,34 @@ class Site extends BaseModel {
     return this;
   }
 
+  /**
+   * Sets the site config, guarding it against the config schema
+   * (`validateConfiguration`). Overrides the auto-generated setter so every
+   * writer (e.g. the `PATCH /sites/{id}` config merge) is checked at one
+   * chokepoint. Behavior is governed by `CONFIG_VALIDATION_ENFORCEMENT`
+   * (default `warn`; `enforce` throws; `off` skips) — see
+   * config-validation-guard.js for the rollout rationale.
+   *
+   * Note: this only guards writes. Reads still go through the lenient
+   * `Config()` getter (attribute `get:` transform), which intentionally
+   * tolerates legacy invalid config already stored on existing sites so a
+   * bad historical record doesn't break every read of that site.
+   *
+   * @param {object} value - candidate config object
+   * @returns {this}
+   */
+  setConfig(value) {
+    guardConfigValidation({
+      entityName: Site.ENTITY_NAME,
+      entityId: this.getId(),
+      value,
+      validate: validateConfiguration,
+      log: this.log,
+    });
+    this.patcher.patchValue('config', value, false);
+    return this;
+  }
+
   /**
    * Resolves the site's base URL to a final URL by fetching the URL,
    * following the redirects and returning the final URL.

package/src/util/config-validation-guard.js

@@ -0,0 +1,76 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import { ValidationError } from '../errors/index.js';
+
+export const ENFORCEMENT_MODES = {
+  OFF: 'off',
+  WARN: 'warn',
+  ENFORCE: 'enforce',
+};
+
+/**
+ * Resolves the config-validation enforcement mode from the environment.
+ *
+ * `CONFIG_VALIDATION_ENFORCEMENT` ∈ { off, warn, enforce }; defaults to `warn`.
+ * Read at call time so deployments (and tests) can flip it without a re-import.
+ *
+ * Rollout rationale: `Site.setConfig()` previously accepted any value with no
+ * schema validation at all on the update path (only entity `create()` runs
+ * attribute validation — see base.collection.js `#validateItem`/`#prepareItem`).
+ * Some existing sites carry legacy config that already fails today's Joi
+ * schema (e.g. an `imports` entry that predates a stricter schema addition).
+ * Flipping straight to `enforce` would reject unrelated PATCH requests on
+ * those sites. Ship `warn` first to surface violations in logs, then flip to
+ * `enforce` once legacy data is cleaned up or confirmed rare.
+ *
+ * @returns {string} one of ENFORCEMENT_MODES
+ */
+export const getConfigEnforcementMode = () => {
+  const raw = (process.env.CONFIG_VALIDATION_ENFORCEMENT || '').trim().toLowerCase();
+  return Object.values(ENFORCEMENT_MODES).includes(raw) ? raw : ENFORCEMENT_MODES.WARN;
+};
+
+/**
+ * Guards a config write. Validates `value` against the config schema via
+ * `validateConfiguration`. A valid config passes silently. An invalid config
+ * is, depending on the enforcement mode, ignored (`off`), logged without
+ * blocking (`warn`), or rejected (`enforce`).
+ *
+ * @param {object} params
+ * @param {string} params.entityName - e.g. 'Site' (for the log message)
+ * @param {string} [params.entityId] - entity id (for the log message)
+ * @param {object} params.value - the candidate config object
+ * @param {(value: object) => object} params.validate - validateConfiguration
+ * @param {object} [params.log] - logger with a `warn` method
+ * @throws {ValidationError} in `enforce` mode when validation fails
+ */
+export const guardConfigValidation = ({
+  entityName, entityId, value, validate, log,
+}) => {
+  const mode = getConfigEnforcementMode();
+  if (mode === ENFORCEMENT_MODES.OFF) {
+    return;
+  }
+
+  try {
+    validate(value);
+  } catch (error) {
+    const message = `config validation violation: ${entityName} ${entityId ?? '<unknown>'}: ${error.message}`;
+    if (log) {
+      log.warn(message);
+    }
+
+    if (mode === ENFORCEMENT_MODES.ENFORCE) {
+      throw new ValidationError(`Invalid config for ${entityName}: ${error.message}`);
+    }
+  }
+};