[GitHub] [accumulo] ctubbsii commented on a change in pull request #1409: Corrected servlet parameter handling so that it does not break things

[GitBox <gi...@apache.org>]

ctubbsii commented on a change in pull request #1409: Corrected servlet parameter handling so that it does not break things
URL: https://github.com/apache/accumulo/pull/1409#discussion_r342121222
 
 

 ##########
 File path: server/monitor/src/main/java/org/apache/accumulo/monitor/servlets/trace/ShowTrace.java
 ##########
 @@ -45,9 +46,11 @@
   private static final long serialVersionUID = 1L;
   private static final String checkboxIdSuffix = "_checkbox";
   private static final String pageLoadFunctionName = "pageload";
+  private static final Pattern TRACE_ID_PATTERN = Pattern.compile("\\p{XDigit}{16}");
 
   String getTraceId(HttpServletRequest req) {
-    return getStringParameter(req, "id", null);
+    final String stringValue = getStringParameter(req, "id", null);
+    return TRACE_ID_PATTERN.matcher(stringValue).matches() ? stringValue : null;
 
 Review comment:
   This looks like it could produce an NPE from the matcher if `stringValue` is null. We probably want to add a check for that:
   
   ```suggestion
       if (stringValue == null) {
         return null;
       }
       return TRACE_ID_PATTERN.matcher(stringValue).matches() ? stringValue : null;
   ```
   

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services