fix: defend against bad inputs to eventLayout

Zachary Haber · Zachary Haber · commit 6ed8354d025f · 2022-06-23T08:30:00.000-05:00
diff --git a/lib/index.js b/lib/index.js
@@ -34,6 +34,10 @@ function getErrorStack(logData) {
  * @param {import('../types').LogFacesHTTPAppender} config
  */
 function logFacesAppender(config) {
+  if (config.eventLayout && typeof config.eventLayout !== 'function') {
+    throw new TypeError('eventLayout must be a function');
+  }
+
   const sender = axios.create({
     baseURL: config.url,
     timeout: config.timeout || 5000,
@@ -95,6 +99,17 @@ function logFacesAppender(config) {
         // no event object returned, consider the event ignored
         return;
       }
+      if (
+        typeof lfsEvent !== 'object' ||
+        Array.isArray(lfsEvent) ||
+        Object.keys(lfsEvent).length < 3
+      ) {
+        // eslint-disable-next-line no-console
+        console.error(
+          `log4js.logFaces-HTTP Appender eventLayout must be an object`
+        );
+        return;
+      }
     }
     if (lfsEvent.m == null) {
       // Add the default message on if not set
diff --git a/test/tap/index-test.js b/test/tap/index-test.js
@@ -21,7 +21,9 @@ function setupLogging(category, enableCallStack, options) {
       };
     },
   };
-
+  /**
+   * @type {{msg?: string, error(msg:string):void}}
+   */
   const fakeConsole = {
     error(msg) {
       this.msg = msg;
@@ -234,7 +236,40 @@ test('logFaces appender', (batch) => {
 
     t.end();
   });
+  batch.test('eventLayout should error if set incorrectly', (t) => {
+    t.throws(() => {
+      setupLogging('myCategory', false, {
+        application: 'LFS-HTTP',
+        url: 'http://localhost/receivers/rx1',
+        eventLayout: 'banana',
+      });
+    });
+    const setup = setupLogging('myCategory', false, {
+      application: 'LFS-HTTP',
+      url: 'http://localhost/receivers/rx1',
+      eventLayout: (event) => {
+        if (event.data[0] === 'array') {
+          return [];
+        }
+        if (event.data[0] === 'string') {
+          return 'string';
+        }
+        if (event.data[0] === 'object') {
+          return {};
+        }
+        return undefined;
+      },
+    });
+    const message =
+      'log4js.logFaces-HTTP Appender eventLayout must be an object';
+    ['array', 'string', 'object'].forEach((input) => {
+      setup.logger.info(input);
+      t.equal(setup.fakeConsole.msg, message);
+      setup.fakeConsole.msg = undefined;
+    });
 
+    t.end();
+  });
   batch.test('eventLayout should enable changing the results', (t) => {
     const setup = setupLogging('myCategory', false, {
       application: 'LFS-HTTP',
