`tag_on_exception` configuration parameter is an unvalidated string.
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 45/100
Research direction
Start by reading lib/logstash/filters/ruby.rb, especially the tag_on_exception configuration and the exception path shown in the report. Reproduce the string and array configurations from the issue, then add focused coverage where the existing test suite places plugin configuration tests. Done means invalid tag_on_exception values no longer escape the exception handler or shut down the pipeline.
Written by the indexing model from the issue text.
Description
The tag_on_exception configuration parameter is not validated, which allows users to add invalid values, which will go undetected until an exception occurs inside the plugin, which will then kill the plugin instead of catching the exception, and tagging the event. This is particularly problematic as the parameter is defined as a string type - it is a common pattern in other Logstash plugins to allow multiple tags to be added by configuring such settings with an array of strings, but doing that in this plugin will cause the exception to escape, and the plugin to crash:
Simple Ruby filter with a single exception correctly tags the event and carries on:
filter { ruby { code => "bogus.get" tag_on_exception => "failed"}}
[2023-06-15T12:24:09,986][ERROR][logstash.filters.ruby ][main][4d7292b9d4c8703ca0ea53c1467ec7c63d156961c9f2b2e13915a348e8642b1e] Ruby exception occurred: undefined local variable or method `bogus' for #<LogStash::Filters::Ruby:0x75d5a06a> {:class=>"NameError", :backtrace=>["(ruby filter code):2:in `block in filter_method'", "/Users/robbavey/logstash-8.7.0/vendor/bundle/jruby/2.6.0/gems/logstash-filter-ruby-3.1.8/lib/logstash/filters/ruby.rb:96:in `inline_script'", "/Users/robbavey/logstash-8.7.0/vendor/bundle/jruby/2.6.0/gems/logstash-filter-ruby-3.1.8/lib/logstash/filters/ruby.rb:89:in `filter'", "/Users/robbavey/logstash-8.7.0/logstash-core/lib/logstash/filters/base.rb:159:in `do_filter'", "/Users/robbavey/logstash-8.7.0/logstash-core/lib/logstash/filters/base.rb:178:in `block in multi_filter'", "org/jruby/RubyArray.java:1865:in `each'", "/Users/robbavey/logstash-8.7.0/logstash-core/lib/logstash/filters/base.rb:175:in `multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:133:in `multi_filter'", "/Users/robbavey/logstash-8.7.0/logstash-core/lib/logstash/java_pipeline.rb:304:in `block in start_workers'"]}
{
"@version" => "1",
"host" => {
"hostname" => "robbaveys-MacBook-Pro.local"
},
"event" => {
"original" => "1"
},
"@timestamp" => 2023-06-15T16:20:06.717245Z,
"message" => "1",
"tags" => [
[0] "failed"
]
}
Changing that to an array:
filter { ruby { code => "bogus.get" tag_on_exception => ["failed", "really_failed"]}}
Causes the exception to escape and the pipeline to shutdown:
[2023-06-15T12:26:30,755][ERROR][logstash.filters.ruby ][main][a24ce623f875d2bbe4ea00758a4db30ee2636e5a91440579aafba607364911bc] Ruby exception occurred: undefined local variable or method `bogus' for #<LogStash::Filters::Ruby:0x3d1273e2> {:class=>"NameError", :backtrace=>["(ruby filter code):2:in `block in filter_method'", "/Users/robbavey/logstash-8.7.0/vendor/bundle/jruby/2.6.0/gems/logstash-filter-ruby-3.1.8/lib/logstash/filters/ruby.rb:96:in `inline_script'", "/Users/robbavey/logstash-8.7.0/vendor/bundle/jruby/2.6.0/gems/logstash-filter-ruby-3.1.8/lib/logstash/filters/ruby.rb:89:in `filter'", "/Users/robbavey/logstash-8.7.0/logstash-core/lib/logstash/filters/base.rb:159:in `do_filter'", "/Users/robbavey/logstash-8.7.0/logstash-core/lib/logstash/filters/base.rb:178:in `block in multi_filter'", "org/jruby/RubyArray.java:1865:in `each'", "/Users/robbavey/logstash-8.7.0/logstash-core/lib/logstash/filters/base.rb:175:in `multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:133:in `multi_filter'", "/Users/robbavey/logstash-8.7.0/logstash-core/lib/logstash/java_pipeline.rb:304:in `block in start_workers'"]}
[2023-06-15T12:26:30,757][ERROR][logstash.javapipeline ][main] Pipeline worker error, the pipeline will be stopped {:pipeline_id=>"main", :error=>"(TypeError) no implicit conversion of Array into String", :exception=>Java::OrgJrubyExceptions::TypeError, :backtrace=>["RUBY.inline_script(/Users/robbavey/logstash-8.7.0/vendor/bundle/jruby/2.6.0/gems/logstash-filter-ruby-3.1.8/lib/logstash/filters/ruby.rb:105)", "RUBY.filter(/Users/robbavey/logstash-8.7.0/vendor/bundle/jruby/2.6.0/gems/logstash-filter-ruby-3.1.8/lib/logstash/filters/ruby.rb:89)", "RUBY.do_filter(/Users/robbavey/logstash-8.7.0/logstash-core/lib/logstash/filters/base.rb:159)", "RUBY.multi_filter(/Users/robbavey/logstash-8.7.0/logstash-core/lib/logstash/filters/base.rb:178)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1865)", "RUBY.multi_filter(/Users/robbavey/logstash-8.7.0/logstash-core/lib/logstash/filters/base.rb:175)", "org.logstash.config.ir.compiler.AbstractFilterDelegatorExt.multi_filter(org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:133)", "RUBY.start_workers(/Users/robbavey/logstash-8.7.0/logstash-core/lib/logstash/java_pipeline.rb:304)"], :thread=>"#<Thread:0x3258cee5@/Users/robbavey/logstash-8.7.0/logstash-core/lib/logstash/java_pipeline.rb:134 sleep>"}
[2023-06-15T12:26:30,758][WARN ][logstash.javapipeline ][main] Waiting for input plugin to close {:pipeline_id=>"main", :thread=>"#<Thread:0x3258cee5@/Users/robbavey/logstash-8.7.0/logstash-core/lib/logstash/java_pipeline.rb:134 run>"}
[2023-06-15T12:26:33,363][INFO ][logstash.javapipeline ][main] Pipeline terminated {"pipeline.id"=>"main"}
[2023-06-15T12:26:33,838][INFO ][logstash.pipelinesregistry] Removed pipeline from registry successfully {:pipeline_id=>:main}
- Dominant language
- Ruby
- Stars
- 18
- Forks
- 32
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from logstash-plugins/logstash-filter-ruby
-
bug
Difficulty 3/5 1-2 days Newbie friendliness 35/100
-
bug docs
Difficulty 2/5 1-3 hours Newbie friendliness 45/100
-
exception-handling
Difficulty 2/5 1-3 hours Newbie friendliness 52/100
-
exception-handling logging-improvements
logstash-plugins/logstash-filter-ruby#49 · 2 comments · 2 assignees ·
-
docs
Difficulty 5/5 Over a week Newbie friendliness 30/100
logstash-plugins/logstash-filter-ruby#42 · 3 comments · 1 reaction ·
All issues in logstash-plugins/logstash-filter-ruby
Similar issues
-
user-reported
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Kong/developer.konghq.com#7316 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
TheOdinProject/curriculum#31408 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
notch8/utk_knapsack#148 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
Homebrew/homebrew-cask#288729 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100