diff --git a/plugins/in_http/http_prot.c b/plugins/in_http/http_prot.c index d0d73376a57..857f1469bd4 100644 --- a/plugins/in_http/http_prot.c +++ b/plugins/in_http/http_prot.c @@ -764,15 +764,23 @@ static int process_payload(struct flb_http *ctx, struct http_conn *conn, return -1; } - if (((header->val.len == 16 && strncasecmp(header->val.data, "application/json", 16) == 0)) || - ((header->val.len > 16 && (strncasecmp(header->val.data, "application/json ", 17) == 0)) || - strncasecmp(header->val.data, "application/json;", 17) == 0)) { - type = HTTP_CONTENT_JSON; + if (header->val.len >= 16 && strncasecmp(header->val.data, "application/json", 16) == 0) { + /* Validate that the character after the matched prefix is acceptable */ + if (header->val.len == 16 || + header->val.data[16] == ';' || + isspace((unsigned char)header->val.data[16])) { + type = HTTP_CONTENT_JSON; + } } - if (header->val.len == 33 && + if (header->val.len >= 33 && strncasecmp(header->val.data, "application/x-www-form-urlencoded", 33) == 0) { - type = HTTP_CONTENT_URLENCODED; + /* Validate that the character after the matched prefix is acceptable */ + if (header->val.len == 33 || + header->val.data[33] == ';' || + isspace((unsigned char)header->val.data[33])) { + type = HTTP_CONTENT_URLENCODED; + } } if (type == -1) { @@ -1223,12 +1231,22 @@ static int process_payload_ng(flb_sds_t tag, return -1; } - if (strcasecmp(request->content_type, "application/json") == 0) { - type = HTTP_CONTENT_JSON; + if (strncasecmp(request->content_type, "application/json", 16) == 0) { + /* Validate that the character after the matched prefix is acceptable */ + if (strlen(request->content_type) == 16 || + request->content_type[16] == ';' || + isspace((unsigned char)request->content_type[16])) { + type = HTTP_CONTENT_JSON; + } } - if (strcasecmp(request->content_type, "application/x-www-form-urlencoded") == 0) { - type = HTTP_CONTENT_URLENCODED; + if (strncasecmp(request->content_type, "application/x-www-form-urlencoded", 33) == 0) { + /* Validate that the character after the matched prefix is acceptable */ + if (strlen(request->content_type) == 33 || + request->content_type[33] == ';' || + isspace((unsigned char)request->content_type[33])) { + type = HTTP_CONTENT_URLENCODED; + } } if (type == -1) { diff --git a/src/http_server/flb_hs_endpoints.c b/src/http_server/flb_hs_endpoints.c index ffda448bfb1..4aafcc060ca 100644 --- a/src/http_server/flb_hs_endpoints.c +++ b/src/http_server/flb_hs_endpoints.c @@ -40,57 +40,12 @@ static int endpoint_root(struct flb_hs *hs) msgpack_sbuffer_init(&mp_sbuf); msgpack_packer_init(&mp_pck, &mp_sbuf, msgpack_sbuffer_write); + /* Return minimal information without sensitive details */ msgpack_pack_map(&mp_pck, 1); - msgpack_pack_str(&mp_pck, 10); - msgpack_pack_str_body(&mp_pck, "fluent-bit", 10); - - /* entries under fluent-bit parent: - * - * - version - * - edition - * - built flags - */ - msgpack_pack_map(&mp_pck, 3); - - /* fluent-bit['version'] */ - msgpack_pack_str(&mp_pck, 7); - msgpack_pack_str_body(&mp_pck, "version", 7); - msgpack_pack_str(&mp_pck, sizeof(FLB_VERSION_STR) - 1); - msgpack_pack_str_body(&mp_pck, FLB_VERSION_STR, sizeof(FLB_VERSION_STR) - 1); - - /* fluent-bit['edition'] */ - msgpack_pack_str(&mp_pck, 7); - msgpack_pack_str_body(&mp_pck, "edition", 7); -#ifdef FLB_ENTERPRISE - msgpack_pack_str(&mp_pck, 10); - msgpack_pack_str_body(&mp_pck, "Enterprise", 10); -#else - msgpack_pack_str(&mp_pck, 9); - msgpack_pack_str_body(&mp_pck, "Community", 9); -#endif - - /* fluent-bit['flags'] */ - msgpack_pack_str(&mp_pck, 5); - msgpack_pack_str_body(&mp_pck, "flags", 5); - - c = 0; - list = flb_utils_split(FLB_INFO_FLAGS, ' ', -1); - mk_list_foreach(head, list) { - entry = mk_list_entry(head, struct flb_split_entry, _head); - if (strncmp(entry->value, "FLB_", 4) == 0) { - c++; - } - } - - msgpack_pack_array(&mp_pck, c); - mk_list_foreach(head, list) { - entry = mk_list_entry(head, struct flb_split_entry, _head); - if (strncmp(entry->value, "FLB_", 4) == 0) { - msgpack_pack_str(&mp_pck, entry->len); - msgpack_pack_str_body(&mp_pck, entry->value, entry->len); - } - } - flb_utils_split_free(list); + msgpack_pack_str(&mp_pck, 6); + msgpack_pack_str_body(&mp_pck, "status", 6); + msgpack_pack_str(&mp_pck, 2); + msgpack_pack_str_body(&mp_pck, "ok", 2); /* export as JSON */ out_buf = flb_msgpack_raw_to_json_sds(mp_sbuf.data, mp_sbuf.size, FLB_TRUE);