@adobe/spacecat-shared-data-access 4.15.2 → 4.15.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +6 -0
- package/package.json +1 -1
- package/src/models/site/config.js +12 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,9 @@
|
|
|
1
|
+
## [@adobe/spacecat-shared-data-access-v4.15.3](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-data-access-v4.15.2...@adobe/spacecat-shared-data-access-v4.15.3) (2026-07-29)
|
|
2
|
+
|
|
3
|
+
### Bug Fixes
|
|
4
|
+
|
|
5
|
+
* bound cdnlogsFilter value length and entry counts ([#1855](https://github.com/adobe/spacecat-shared/issues/1855)) ([ec88c22](https://github.com/adobe/spacecat-shared/commit/ec88c2202f8c3fabd75c3a35be21589a8f7bf29d))
|
|
6
|
+
|
|
1
7
|
## [@adobe/spacecat-shared-data-access-v4.15.2](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-data-access-v4.15.1...@adobe/spacecat-shared-data-access-v4.15.2) (2026-07-29)
|
|
2
8
|
|
|
3
9
|
### Bug Fixes
|
package/package.json
CHANGED
|
@@ -85,12 +85,22 @@ export const CDN_LOGS_FILTER_KEYS = [
|
|
|
85
85
|
'cdn_provider',
|
|
86
86
|
];
|
|
87
87
|
|
|
88
|
-
|
|
88
|
+
// Bounds on the filter values. `value` entries become Athena regex patterns
|
|
89
|
+
// downstream; SQL injection is already prevented by escaping in the audit worker,
|
|
90
|
+
// but capping length/count limits regex abuse (ReDoS) and stored size.
|
|
91
|
+
const CDN_LOGS_FILTER_MAX_ENTRIES = 50;
|
|
92
|
+
const CDN_LOGS_FILTER_MAX_VALUES = 100;
|
|
93
|
+
const CDN_LOGS_FILTER_MAX_VALUE_LENGTH = 500;
|
|
94
|
+
|
|
95
|
+
const CDN_LOGS_FILTER_SCHEMA = Joi.array().max(CDN_LOGS_FILTER_MAX_ENTRIES).items(
|
|
89
96
|
Joi.object({
|
|
90
97
|
// Athena folds column identifiers to lowercase; normalize before matching
|
|
91
98
|
// the allowlist so a stored 'X_forwarded_host' is accepted as the same column.
|
|
92
99
|
key: Joi.string().lowercase().valid(...CDN_LOGS_FILTER_KEYS).required(),
|
|
93
|
-
value: Joi.array()
|
|
100
|
+
value: Joi.array()
|
|
101
|
+
.max(CDN_LOGS_FILTER_MAX_VALUES)
|
|
102
|
+
.items(Joi.string().max(CDN_LOGS_FILTER_MAX_VALUE_LENGTH))
|
|
103
|
+
.required(),
|
|
94
104
|
type: Joi.string().valid('include', 'exclude').optional(),
|
|
95
105
|
}),
|
|
96
106
|
);
|