revert: revert fix CLRF attack (#22)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zenvia/logger",
-  "version": "1.6.1",
+  "version": "1.6.2",
   "description": "A wrapper for Winston Logging Node.js library that formats the output on STDOUT as Logstash JSON format.",
   "license": "MIT",
   "main": "./src/index",

src/lib/logger.js

@@ -10,25 +10,7 @@ const rTrace = require('cls-rtracer');
 
 const appPackage = require(path.join(appRootDir, 'package'));
 
-const sanitizeInfo = (info) => {
-  const sanitizeCRLFInjection = (str) => str
-    .replace(/\n|\r/g, (x) => (x === '\n' ? '#n' : '#r'));
-
-  Object.keys(info).forEach((key) => {
-    if (typeof info[key] === 'string') {
-      info[key] = sanitizeCRLFInjection(info[key]);
-      return;
-    }
-
-    if (info[key] instanceof Function) {
-      delete info[key];
-    }
-  });
-};
-
 const customFormatJson = winston.format((info) => {
-  sanitizeInfo(info);
-
   let stack;
 
   if (info.stack) {
@@ -49,6 +31,12 @@ const customFormatJson = winston.format((info) => {
     traceId: rTrace.id(),
   };
 
+  Object.keys(info).forEach((key) => {
+    if (info[key] instanceof Function) {
+      delete info[key];
+    }
+  });
+
   return info;
 });
 

test/lib/logger.spec.js

@@ -70,6 +70,21 @@ describe('Logger test', () => {
       JSON.parse(actualOutput).should.be.deep.equal(expectedOutput);
     });
 
+    it('should remove attributes that are log functions, leaving only the @timestamp, application, message and level fields', () => {
+      logger.info('some message', { field1: () => {} });
+      const expectedOutput = {
+        '@timestamp': '2018-06-05T18:20:42.345Z',
+        '@version': 1,
+        application: 'application-name',
+        host: os.hostname(),
+        message: 'some message',
+        level: 'INFO',
+      };
+
+      const actualOutput = stdMocks.flush().stdout[0];
+      JSON.parse(actualOutput).should.be.deep.equal(expectedOutput);
+    });
+
     it('should log @timestamp, application, message, level and environment fields', () => {
       process.env.NODE_ENV = 'test';
       logger.info('some message');
@@ -241,50 +256,6 @@ describe('Logger test', () => {
   });
 
   describe('Logging format', () => {
-    it('should replace LF characters from log (POSIX systems)', () => {
-      logger.debug(`some message
-other CRLF injection message`);
-      const expectedOutput = {
-        '@timestamp': '2018-06-05T18:20:42.345Z',
-        '@version': 1,
-        application: 'application-name',
-        host: os.hostname(),
-        message: 'some message#nother CRLF injection message',
-        level: 'DEBUG',
-      };
-
-      const actualOutput = stdMocks.flush().stdout[0];
-      JSON.parse(actualOutput).should.be.deep.equal(expectedOutput);
-
-      logger.debug('some\n CRLF\n injection\n message');
-      const expectedOutput2 = {
-        '@timestamp': '2018-06-05T18:20:42.345Z',
-        '@version': 1,
-        application: 'application-name',
-        host: os.hostname(),
-        message: 'some#n CRLF#n injection#n message',
-        level: 'DEBUG',
-      };
-
-      const actualOutput2 = stdMocks.flush().stdout[0];
-      JSON.parse(actualOutput2).should.be.deep.equal(expectedOutput2);
-    });
-
-    it('should replace CRLF characters from log (Windows systems)', () => {
-      logger.debug('some\r\n CRLF\r\n injection\r\n message');
-      const expectedOutput = {
-        '@timestamp': '2018-06-05T18:20:42.345Z',
-        '@version': 1,
-        application: 'application-name',
-        host: os.hostname(),
-        message: 'some#r#n CRLF#r#n injection#r#n message',
-        level: 'DEBUG',
-      };
-
-      const actualOutput = stdMocks.flush().stdout[0];
-      JSON.parse(actualOutput).should.be.deep.equal(expectedOutput);
-    });
-
     it('should get not format when LOGGING_FORMATTER_DISABLED environment is true', () => {
       delete require.cache[require.resolve('../../src/lib/logger')];
       process.env.LOGGING_FORMATTER_DISABLED = 'true';