Potential fix for code scanning alert no. 10: Log Injection

.github/dependabot.yml

@@ -0,0 +1,8 @@
+# Scanning the Maven dependencies and creating pull requests to update them.
+version: 2
+updates:
+  - package-ecosystem: "maven"
+    directory: "/" # Location of pom.xml ("/" = repo root)
+    schedule:
+      interval: "daily"
+    target-branch: "develop" # PRs go to develop branch

README.md

@@ -2,15 +2,15 @@
 
 ![logo](doc/dispatcher-services-logo.png)
 
-[![Github](https://img.shields.io/badge/github-1.4.8-green?style=flat&logo=github)](https://github.com/eipm/DispatcherSuite) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.14975839.svg)](https://zenodo.org/doi/10.5281/zenodo.14975839)
+[![Github](https://img.shields.io/badge/github-1.4.9-green?style=flat&logo=github)](https://github.com/eipm/DispatcherSuite) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.14975839.svg)](https://zenodo.org/doi/10.5281/zenodo.14975839)
 
 A set of microservices to interface with different messaging systems.
 
 ## 🤝 License
 See [LICENSE](./LICENSE)
 
 ## 📚 How to Cite
-> Manuele Simi, Alexandros Sigaras, Jeff Tang, & Pantelis Zisimopoulos. (2025). eipm/DispatcherSuite: v1.4.8 (v1.4.8). Zenodo. [https://zenodo.org/records/14975856](https://zenodo.org/records/14975856)
+> Manuele Simi, Alexandros Sigaras, Jeff Tang, & Pantelis Zisimopoulos. (2025). eipm/DispatcherSuite: v1.4.9 (v1.4.9). Zenodo. [https://zenodo.org/records/14975856](https://zenodo.org/records/14975856)
 
 ## Modules
 * [Kafka-Dispatcher Service](kafka-service/README.md) - to interface with Apache Kafka brokers (on-prem or on the cloud, like Microsoft EventHubs or AWS MSK)

SECURITY.md

@@ -7,8 +7,8 @@ currently being supported with security updates.
 
 | Version | Supported          |
 |---------| ------------------ |
-| 1.4.8   | :white_check_mark: |
-| < 1.4.8 | :x:                |
+| 1.4.9   | :white_check_mark: |
+| < 1.4.9 | :x:                |
 
 ## Reporting a Vulnerability
 

kafka-service/pom.xml

@@ -10,7 +10,7 @@
     <modelVersion>4.0.0</modelVersion>
 
     <artifactId>kafka-service</artifactId>
-    <version>1.4.8</version>
+    <version>1.4.9</version>
     <name>Kafka Dispatcher service</name>
     <packaging>war</packaging>
 
@@ -94,6 +94,18 @@
             <scope>test</scope>
         </dependency>
 
+        <dependency>
+            <groupId>commons-beanutils</groupId>
+            <artifactId>commons-beanutils</artifactId>
+            <version>[1.11.0,1.12.0)</version>
+        </dependency>
+
+        <dependency>
+            <groupId>commons-io</groupId>
+            <artifactId>commons-io</artifactId>
+            <version>[2.14.0,2.15.0)</version>
+        </dependency>
+
         <dependency>
             <groupId>junit</groupId>
             <artifactId>junit</artifactId>

kafka-service/runApp.sh

@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-java -jar target/kafka-service-1.4.8.war -Dspring.config.location=/path/to/EIPM/DispatcherSuite/kafka-service/application.yml
+java -jar target/kafka-service-1.4.9.war -Dspring.config.location=/path/to/EIPM/DispatcherSuite/kafka-service/application.yml

kafka-service/runContainer.sh

@@ -10,4 +10,4 @@ WORKING_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
  -v /path/to/tmp/:/tmp \
  -v /path/to/DispatcherSuite/kafka-service/log/:/log \
  -v "${WORKING_DIR}/application.yml":/application.yml \
-  eipm/kafka-dispatcher:1.4.8
+  eipm/kafka-dispatcher:1.4.9

kafka-service/runSSLContainer.sh

@@ -7,5 +7,5 @@ docker run -p 8443:8443 --rm  \
  -e HOST_USER=$LOGNAME \
  -v "${WORKING_DIR}/application-ssl.yml":/application.yml \
   -v /path/to//DispatcherSuite/kafka-service/scripts/kd-keystore.jks:/kd-keystore.jks \
-  eipm/kafka-dispatcher:1.4.8
+  eipm/kafka-dispatcher:1.4.9
 

kafka-service/src/main/java/edu/cornell/eipm/messaging/microservices/kafka/dispatcher/broker/producer/Sender.java

@@ -50,19 +50,21 @@
    * @param values the values to send as message's payload
    */
   public void send(String topic, Map<String, String> values) {
+    // Sanitize the topic parameter to prevent log injection
+    String sanitizedTopic = topic.replace("\n", "").replace("\r", "");
     String json = new JSONPayloadSerializer(values).toJSON();
-    LOGGER.info("sending payload='{}' to topic {}", json, topic);
-    CompletableFuture<SendResult<String, String>> future = kafkaTemplate.send(topic, topic, json);
+    LOGGER.info("sending payload='{}' to topic {}", json, sanitizedTopic);
+    CompletableFuture<SendResult<String, String>> future = kafkaTemplate.send(sanitizedTopic, sanitizedTopic, json);
     future.whenCompleteAsync(
         (result, throwable) -> {
           if (throwable != null) {
             LOGGER.error(
-                "Unable to send message to =[" + topic + "] due to : " + throwable.getMessage());
+                "Unable to send message to =[" + sanitizedTopic + "] due to : " + throwable.getMessage());
             future.completeExceptionally(throwable);
           } else {
             LOGGER.info(
                 "Sent message to topic=["
-                    + topic
+                    + sanitizedTopic
                     + "] with offset=["
                     + result.getRecordMetadata().offset()
                     + "]");

pom.xml

@@ -10,7 +10,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.5.3</version>
+        <version>3.5.4</version>
         <relativePath/> <!-- lookup parent from repository -->
     </parent>
     <groupId>edu.cornell.eipm.messaging.microservices</groupId>
@@ -22,7 +22,7 @@
 
     <properties>
         <java.version>18</java.version>
-        <spotless.version>2.41.1</spotless.version>
+        <spotless.version>2.46.1</spotless.version>
     </properties>
 
     <build>