Opensearch transport query sanitization #15634
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| /* | ||
| * Copyright The OpenTelemetry Authors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| package io.opentelemetry.javaagent.instrumentation.opensearch.v3_0; | ||
|
|
||
| import static java.util.logging.Level.FINE; | ||
|
|
||
| import jakarta.json.stream.JsonGenerator; | ||
| import java.io.ByteArrayOutputStream; | ||
| import java.nio.charset.StandardCharsets; | ||
| import java.util.Iterator; | ||
| import java.util.logging.Logger; | ||
| import javax.annotation.Nullable; | ||
| import org.opensearch.client.json.JsonpMapper; | ||
| import org.opensearch.client.json.NdJsonpSerializable; | ||
| import org.opensearch.client.transport.GenericSerializable; | ||
|
|
||
| public final class OpenSearchBodyExtractor { | ||
|
|
||
| private static final Logger logger = Logger.getLogger(OpenSearchBodyExtractor.class.getName()); | ||
|
|
||
| @Nullable | ||
| public static String extract(JsonpMapper mapper, Object request) { | ||
| try { | ||
| ByteArrayOutputStream baos = new ByteArrayOutputStream(); | ||
|
|
||
| if (request instanceof NdJsonpSerializable) { | ||
| writeNdJson(mapper, (NdJsonpSerializable) request, baos); | ||
| } else if (request instanceof GenericSerializable) { | ||
| ((GenericSerializable) request).serialize(baos); | ||
| } else { | ||
| JsonGenerator generator = mapper.jsonProvider().createGenerator(baos); | ||
| mapper.serialize(request, generator); | ||
| generator.close(); | ||
| } | ||
|
|
||
| String body = baos.toString(StandardCharsets.UTF_8); | ||
| return body.isEmpty() ? null : body; | ||
| } catch (RuntimeException e) { | ||
| logger.log(FINE, "Failure extracting body", e); | ||
| return null; | ||
| } | ||
| } | ||
|
|
||
| private static void writeNdJson( | ||
| JsonpMapper mapper, NdJsonpSerializable value, ByteArrayOutputStream baos) { | ||
| try { | ||
| Iterator<?> values = value._serializables(); | ||
| while (values.hasNext()) { | ||
| Object item = values.next(); | ||
| if (item instanceof NdJsonpSerializable && item != value) { | ||
| // do not recurse on the item itself | ||
| writeNdJson(mapper, (NdJsonpSerializable) item, baos); | ||
| } else { | ||
| JsonGenerator generator = mapper.jsonProvider().createGenerator(baos); | ||
|
Contributor
There was a problem hiding this comment. Just wondering whether instead of serializing the query to json string and then parsing that json, sanitizing it and serializing it again to json string you could wrap the |
||
| mapper.serialize(item, generator); | ||
| generator.close(); | ||
| baos.write('\n'); | ||
| } | ||
| } | ||
| } catch (RuntimeException e) { | ||
| logger.log(FINE, "Failure serializing NdJson", e); | ||
| } | ||
| } | ||
|
|
||
| private OpenSearchBodyExtractor() {} | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,104 @@ | ||
| /* | ||
| * Copyright The OpenTelemetry Authors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| package io.opentelemetry.javaagent.instrumentation.opensearch.v3_0; | ||
|
|
||
| import static java.util.logging.Level.FINE; | ||
|
|
||
| import com.fasterxml.jackson.databind.JsonNode; | ||
| import com.fasterxml.jackson.databind.ObjectMapper; | ||
| import com.fasterxml.jackson.databind.node.ArrayNode; | ||
| import com.fasterxml.jackson.databind.node.ObjectNode; | ||
| import com.fasterxml.jackson.databind.node.TextNode; | ||
| import java.util.ArrayList; | ||
| import java.util.List; | ||
| import java.util.Map; | ||
| import java.util.logging.Logger; | ||
|
|
||
| public final class OpenSearchBodySanitizer { | ||
|
|
||
| private static final Logger logger = Logger.getLogger(OpenSearchBodySanitizer.class.getName()); | ||
|
|
||
| private static final ObjectMapper DEFAULT_OBJECT_MAPPER = new ObjectMapper(); | ||
| private static final String MASKED_VALUE = "?"; | ||
| private static final OpenSearchBodySanitizer DEFAULT_INSTANCE = | ||
| new OpenSearchBodySanitizer(DEFAULT_OBJECT_MAPPER); | ||
|
|
||
| private final ObjectMapper objectMapper; | ||
|
|
||
| private OpenSearchBodySanitizer(ObjectMapper objectMapper) { | ||
| this.objectMapper = objectMapper; | ||
| } | ||
|
|
||
| public static String sanitize(String jsonString) { | ||
| return DEFAULT_INSTANCE.sanitizeInstance(jsonString); | ||
| } | ||
|
|
||
| public String sanitizeInstance(String jsonString) { | ||
| if (jsonString == null) { | ||
| return null; | ||
| } | ||
|
|
||
| List<String> queries = QuerySplitter.splitQueries(jsonString); | ||
| if (queries.isEmpty()) { | ||
| return null; | ||
| } | ||
|
|
||
| List<String> sanitizedQueries = new ArrayList<>(); | ||
| for (String query : queries) { | ||
| String sanitized = sanitizeSingleQuery(query); | ||
| sanitizedQueries.add(sanitized); | ||
| } | ||
|
|
||
| return QuerySplitter.joinQueries(sanitizedQueries); | ||
| } | ||
|
|
||
| private String sanitizeSingleQuery(String query) { | ||
| try { | ||
| JsonNode rootNode = objectMapper.readTree(query); | ||
| JsonNode sanitizedNode = sanitizeNode(rootNode); | ||
| return objectMapper.writeValueAsString(sanitizedNode); | ||
| } catch (Exception e) { | ||
| logger.log(FINE, "Failure sanitizing single query", e); | ||
| return query; | ||
| } | ||
| } | ||
|
|
||
| private JsonNode sanitizeNode(JsonNode node) { | ||
| if (node == null || node.isNull()) { | ||
| return node; | ||
| } | ||
|
|
||
| if (node.isTextual()) { | ||
| return new TextNode(MASKED_VALUE); | ||
| } | ||
|
|
||
| if (node.isNumber() || node.isBoolean()) { | ||
| return new TextNode(MASKED_VALUE); | ||
| } | ||
|
|
||
| if (node.isArray()) { | ||
| ArrayNode arrayNode = objectMapper.createArrayNode(); | ||
| for (JsonNode element : node) { | ||
| arrayNode.add(sanitizeNode(element)); | ||
| } | ||
| return arrayNode; | ||
| } | ||
|
|
||
| if (node.isObject()) { | ||
| ObjectNode objectNode = objectMapper.createObjectNode(); | ||
|
|
||
| for (Map.Entry<String, JsonNode> field : node.properties()) { | ||
| String key = field.getKey(); | ||
| JsonNode value = field.getValue(); | ||
|
|
||
| objectNode.set(key, sanitizeNode(value)); | ||
| } | ||
| return objectNode; | ||
| } | ||
|
|
||
| return node; | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this change seems unrelated to opensearch