Skip to content
This repository has been archived by the owner on Jul 14, 2021. It is now read-only.

Conversation

sfgeorge
Copy link

DTPORTAL-16626 [RUBYAMI] Ensure that ASR results from Asterisk 13.5+ can be parsed

Description

Characters like ' " and ? now have backslashes in front of them on VarSet events (\' \" \?). Unescape the escaped characters so that RubyAMI exposes the original, true value of encoded channel variables.

This PR partially-addresses adhearsion#47, but without the logic yet to only perform this decoding for AMI_VERSION >= 2.8.0; that will be addressed in a future PR.

Changes

This code adds/modifies/uses:

  • Credentials
  • SQL or other datastore queries
  • Exposed API or web endpoints / URLs
  • User input from channels such as GET, POST, Cookie or other.
  • Disk I/O (such as adding logging messages or creating/reading files)

Checklist

Process Checklist

  • I've deployed this PR to DEV.
  • The JIRA story associated with this PR has adequate Acceptance Criteria for QA to begin testing.
  • I've moved this story to the "Code Review" column in JIRA.

Security and Performance Checklist

  • I am @-mentioning a DBA on my PR if it includes new or modified SQL or ElasticSearch queries.
  • I've reviewed my changes for applicable SQL injection, Cross-Site Request Forgery (CSRF), Insecure Direct Object Reference and Cross-Site Scripting (XSS) vulnerabilities.
  • I have avoided introducing new credentials / API keys in plaintext.
  • I have thought about whether my changes will perform well if we receive 10x our typical traffic.

Characters like ' " ? now have backslashes in front of them on VarSet events.
@sfgeorge
Copy link
Author

@gfaza Can you review this for me?

Copy link

@gfaza gfaza left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good - just a couple of comments. fwiw, i used rubocop to inform the two comments. even though it suggests a number of things in specs/ruby_ami/event_spec.rb as well, i think it best to ignore those file's suggestions in order to keep close to the adhearsion/ruby_ami.

@@ -24,6 +39,25 @@ def best_time
timestamp || receipt_time
end

# Set a Header value
# @override RubyAMI::Response
def []=(key,value)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we could use a space after this comma

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good call, fixed

@@ -5,6 +5,21 @@

module RubyAMI
class Event < Response
VAR_SET_ENCODING_PATTERN = /\\[abfnrtv\\'"?]/.freeze
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rubocop tells me that we don't need .freeze here, b/c "Freezing immutable objects is pointless."

Copy link
Author

@sfgeorge sfgeorge Aug 26, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not getting that error with rubocop 0.74.0 and the following .rubocop.yml. Can you share the deets of the failure & rubocop version?

AllCops:
  DisplayCopNames: true
  DisplayStyleGuide: true
  ExtraDetails: true
  TargetRubyVersion: 2.3

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i like your setup better than mine. seems i used ruboocp 0.41.2 in order to get this suggestion regarding the .freeze, and i certainly do not see the suggestion when using your more appropriate setup.

although i understand that a literal regex object is immutable, and shouldn't require a freeze, i'd rather defer to the results that you got - perhaps there's a good reason that the .freeze isn't superfluous when targeting ruby 2.3

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, gotcha. Yeah, that makes sense. Superfluous in Ruby 1.9 but not superfluous afterwards... yeah, freezing seems safer.

Thanks man.

Copy link

@gfaza gfaza left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@sfgeorge
Copy link
Author

@mattcar Can you merge this for me?

FYI @rkodali2, once this is merged then apptastic will be properly updated to point to the latest & greatest of ruby_ami's cloudvox:dialogtech/support/2.x branch.

@mattcar mattcar merged commit 827c659 into cloudvox:dialogtech/support/2.x Aug 26, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants