feat(logging): unified request logging (graphql, openapi, restli) #10802
Conversation
github-actions
bot
added
the
devops
|
Warning Rate limit exceeded@david-leifker has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 19 minutes and 22 seconds before requesting another review. How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. WalkthroughRecent updates have significantly enhanced the Changes
Poem
Tip Early access features
Note:
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (26)
- metadata-operation-context/build.gradle (1 hunks)
- metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java (4 hunks)
- metadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/GraphQLController.java (2 hunks)
- metadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/SpringQueryContext.java (2 hunks)
- metadata-service/openapi-analytics-servlet/build.gradle (1 hunks)
- metadata-service/openapi-analytics-servlet/src/main/java/io/datahubproject/openapi/delegates/DatahubUsageEventsImpl.java (3 hunks)
- metadata-service/openapi-entity-servlet/src/main/java/io/datahubproject/openapi/v2/delegates/EntityApiDelegateImpl.java (13 hunks)
- metadata-service/openapi-entity-servlet/src/main/resources/JavaSpring/apiController.mustache (1 hunks)
- metadata-service/openapi-servlet/build.gradle (1 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/controller/GenericEntitiesController.java (21 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/openlineage/controller/LineageApiImpl.java (3 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/operations/elastic/OperationsController.java (11 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v1/entities/EntitiesController.java (7 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/EntityController.java (3 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/PlatformEntitiesController.java (3 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/TimeseriesController.java (3 hunks)
- metadata-service/openapi-servlet/src/test/java/entities/EntitiesControllerTest.java (1 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/analytics/Analytics.java (3 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/AspectResource.java (5 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/BatchIngestionRunResource.java (2 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.java (23 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityV2Resource.java (2 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityVersionedV2Resource.java (1 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/operations/OperationsResource.java (3 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/operations/Utils.java (3 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/usage/UsageStats.java (3 hunks)
Additional comments not posted (98)
metadata-operation-context/build.gradle (1)
10-11: Confirm dependency versions and usage consistency.The addition of
servletApiandrestliServerdependencies aligns with the PR's objectives. Please ensure that the versions used are consistent with the project's standards and that they do not introduce conflicts with existing dependencies.Verification successful
Confirm dependency versions and usage consistency.
The versions for the dependencies are as follows:
servletApi:jakarta.servlet:jakarta.servlet-api:6.0.0restliServer:com.linkedin.pegasus:restli-server:29.57.0These versions appear consistent with the project's standards as no conflicts were detected in the provided context.
build.gradle:
externalDependency.servletApi = 'jakarta.servlet:jakarta.servlet-api:6.0.0'ext.pegasusVersion = '29.57.0'spec.product.pegasus.restliServer = 'com.linkedin.pegasus:restli-server:29.57.0'Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Check for conflicts in dependencies. # Test: Search for dependency conflicts in gradle files. Expect: No conflicts. rg --type gradle $'implementation externalDependency.servletApi' rg --type gradle $'implementation spec.product.pegasus.restliServer'Length of output: 1433
Script:
#!/bin/bash # Description: Check for version declarations of dependencies. # Search for version declarations of 'servletApi' and 'restliServer' in Gradle files. rg --type gradle 'externalDependency.servletApi' --context 5 rg --type gradle 'spec.product.pegasus.restliServer' --context 5Length of output: 14347
Script:
#!/bin/bash # Description: Check for version declarations of dependencies in common dependency management files. # Search for version declarations of 'externalDependency.servletApi' and 'spec.product.pegasus.restliServer'. rg 'servletApi' build.gradle dependencies.gradle gradle.properties --context 5 rg 'restliServer' build.gradle dependencies.gradle gradle.properties --context 5Length of output: 1926
Script:
#!/bin/bash # Description: Check for the definition of the pegasusVersion variable. # Search for the definition of 'pegasusVersion' in common dependency management files. rg 'pegasusVersion' build.gradle gradle.properties --context 5Length of output: 2496
metadata-service/openapi-analytics-servlet/build.gradle (1)
22-22: Confirm integration ofservletApidependency.The addition of
servletApiis crucial for handling servlet functionalities. Ensure that this dependency is properly integrated and does not conflict with other dependencies.metadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/SpringQueryContext.java (1)
10-10: Review changes inSpringQueryContextfor correctness and integration.Several changes have been made to integrate
HttpServletRequestand improve request handling. Ensure that these changes are correctly implemented, especially the new logic for determiningqueryNameand the integration ofRequestContext.builder().Also applies to: 30-31, 38-50, 55-56
Verification successful
Review changes in
SpringQueryContextfor correctness and integration.The usage of
HttpServletRequestandRequestContext.builder()inSpringQueryContextand related files has been verified:
SpringQueryContext.javacorrectly imports and usesHttpServletRequest.RequestContext.builder()is utilized withinSpringQueryContext.java.These changes appear to be correctly implemented.
- Files verified:
metadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/SpringQueryContext.javametadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/GraphQLController.javaScripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the correct implementation of changes in `SpringQueryContext`. # Test: Search for usages of `HttpServletRequest` and `RequestContext.builder()` in GraphQL handling. Expect: Correct implementation. rg --type java $'HttpServletRequest' -- 'src/main/java/com/datahub/graphql/' rg --type java $'RequestContext.builder()' -- 'src/main/java/com/datahub/graphql/'Length of output: 305
Script:
#!/bin/bash # Description: Verify the correct implementation of changes in `SpringQueryContext`. # Test: Search for usages of `HttpServletRequest` and `RequestContext.builder()` in GraphQL handling. Expect: Correct implementation. rg --type java 'HttpServletRequest' -- 'metadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/' rg --type java 'RequestContext.builder()' -- 'metadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/'Length of output: 1129
metadata-service/openapi-analytics-servlet/src/main/java/io/datahubproject/openapi/delegates/DatahubUsageEventsImpl.java (1)
15-15: Ensure correct usage ofHttpServletRequestinDatahubUsageEventsImpl.The autowiring and usage of
HttpServletRequestare crucial for handling OpenAPI analytics requests. Confirm that it is correctly integrated and used in thebuildOpenapimethod.Also applies to: 31-31, 42-43
Verification successful
Correct usage of
HttpServletRequestinDatahubUsageEventsImplhas been verified.
- The
HttpServletRequestis correctly autowired and used in thebuildOpenapimethod to extract the source IP and user agent.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the correct usage of `HttpServletRequest` in OpenAPI analytics handling. # Test: Search for the usage of `HttpServletRequest` in OpenAPI analytics handling. Expect: Correct usage. rg --type java $'HttpServletRequest' -- 'src/main/java/io/datahubproject/openapi/delegates/'Length of output: 180
Script:
#!/bin/bash # Find the correct path for DatahubUsageEventsImpl.java fd DatahubUsageEventsImpl.java # Once the correct path is found, search for the usage of HttpServletRequest within that file fd DatahubUsageEventsImpl.java --exec rg HttpServletRequestLength of output: 312
Script:
#!/bin/bash # Search for the buildOpenapi method and references to the request field within DatahubUsageEventsImpl.java rg 'buildOpenapi' -A 20 metadata-service/openapi-analytics-servlet/src/main/java/io/datahubproject/openapi/delegates/DatahubUsageEventsImpl.javaLength of output: 749
Script:
#!/bin/bash # Search for the complete implementation of the buildOpenapi method in DatahubUsageEventsImpl.java rg 'private .* buildOpenapi' -A 50 metadata-service/openapi-analytics-servlet/src/main/java/io/datahubproject/openapi/delegates/DatahubUsageEventsImpl.javaLength of output: 157
Script:
#!/bin/bash # Search for the buildOpenapi method by its name and capture a larger context to ensure we get the full implementation rg 'buildOpenapi' -A 100 metadata-service/openapi-analytics-servlet/src/main/java/io/datahubproject/openapi/delegates/DatahubUsageEventsImpl.javaLength of output: 750
Script:
#!/bin/bash # Search for all method definitions in the DatahubUsageEventsImpl.java file rg 'def ' metadata-service/openapi-analytics-servlet/src/main/java/io/datahubproject/openapi/delegates/DatahubUsageEventsImpl.javaLength of output: 132
Script:
#!/bin/bash # Search for method definitions using a pattern that matches typical Java method signatures rg 'public|private|protected [a-zA-Z<>]+ [a-zA-Z0-9_]+\(' metadata-service/openapi-analytics-servlet/src/main/java/io/datahubproject/openapi/delegates/DatahubUsageEventsImpl.javaLength of output: 622
Script:
#!/bin/bash # Search for the definition of the buildOpenapi method across the entire codebase rg 'buildOpenapi' -t javaLength of output: 4643
Script:
#!/bin/bash # Search for the complete implementation of the buildOpenapi method in the RequestContext.java file rg 'buildOpenapi' -A 50 metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 2409
metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/operations/Utils.java (1)
16-16: Confirm correct usage ofResourceContextinUtils.The addition of
ResourceContextand its usage in therestoreIndicesmethod are critical for handling Restli requests. Ensure that it is correctly integrated and used in thebuildRestlimethod.Also applies to: 36-37, 64-64
metadata-service/openapi-servlet/build.gradle (1)
24-24: Dependency additions approved.The added
servletApiandslf4jApidependencies are essential for enhanced request handling and logging, aligning with the PR objectives.metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/openlineage/controller/LineageApiImpl.java (1)
17-17: Proper use of HttpServletRequest for enhanced logging.The autowiring and usage of
HttpServletRequestare correctly implemented to capture and utilize request-specific data, which aligns with the PR's objectives to enhance logging capabilities.Also applies to: 54-54, 74-76
metadata-service/openapi-entity-servlet/src/main/resources/JavaSpring/apiController.mustache (1)
101-101: Proper integration of HttpServletRequest in controller templates.The modification to include
HttpServletRequestin the constructor of generated controllers ensures that request data is properly integrated into the API operations, supporting the PR's logging enhancements.metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/analytics/Analytics.java (1)
17-17: Enhanced request context handling in analytics operations.The introduction of
HttpServletRequestand its usage in building request contexts for analytics operations are correctly implemented, enhancing the logging and monitoring capabilities as intended in the PR.Also applies to: 32-32, 85-86
metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityVersionedV2Resource.java (1)
91-91: Correct implementation of request context in entity handling.The changes to incorporate request-specific data into the entity handling operations are correctly implemented, enhancing the overall functionality and aligning with the PR's objectives.
metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/PlatformEntitiesController.java (2)
20-20: Ensure proper use of HttpServletRequest.The import of
HttpServletRequestis crucial for capturing request-specific data as part of the new logging functionality.
74-75: Review the usage of HttpServletRequest in RequestContext construction.The inclusion of
HttpServletRequestin theRequestContextbuilding process ensures that request-specific data such as IP and user-agent are correctly extracted and logged, aligning with the PR's goals.metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/TimeseriesController.java (3)
25-25: Ensure proper use of HttpServletRequest.The import of
HttpServletRequestis crucial for capturing request-specific data as part of the new logging functionality.
81-83: Review the usage of HttpServletRequest in RequestContext construction.The inclusion of
HttpServletRequestin theRequestContextbuilding process ensures that request-specific data such as IP and user-agent are correctly extracted and logged, aligning with the PR's goals.
60-60: Review the method signature change to include HttpServletRequest.Adding
HttpServletRequestto the method signature ofgetAspectsallows capturing request-specific data which aligns with the PR objectives. Ensure that all calls to this method are updated to pass the requiredHttpServletRequest.metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityV2Resource.java (2)
82-82: Review the usage of RequestContext in thegetmethod.The addition of
RequestContextin thegetmethod ensures that request-specific data is captured and logged, aligning with the PR objectives. This change enhances the traceability and auditability of requests.
126-126: Review the usage of RequestContext in thebatchGetmethod.The addition of
RequestContextin thebatchGetmethod ensures that request-specific data is captured and logged, aligning with the PR objectives. This change enhances the traceability and auditability of requests.metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java (7)
3-5: Proper import statements for handling HTTP requests.The added imports are essential for handling HTTP and ResourceContext requests, which are crucial for extracting source IP and user-agent data.
17-17: Review the addition of the Slf4j logging annotation.The addition of the
@Slf4jlogging annotation is appropriate for enabling logging within theRequestContextclass. This facilitates debugging and monitoring by logging important request-specific information.
27-28: Review the new fields for capturing request details.The addition of
actorUrn,sourceIP, anduserAgentas fields in theRequestContextclass is crucial for capturing and logging request-specific information, which enhances monitoring and security auditing.Also applies to: 37-37
39-52: Review the updated constructor for RequestContext.The updated constructor correctly initializes the new fields and logs the initialized context, which is crucial for traceability and debugging.
61-62: Review the updated builder methods for different API types.The builder methods for
GRAPHQL,RESTLI, andOPENAPIhave been updated to include the new fields and extract request-specific data like source IP and user-agent. These changes are crucial for capturing detailed context information for different types of requests.Also applies to: 65-74, 78-108, 112-130
142-162: Review the utility methods for extracting source IP and user-agent.The utility methods for extracting the source IP and user-agent from both
HttpServletRequestandResourceContextare well-implemented. These methods are crucial for capturing accurate request details.
165-182: Review the updated toString method.The updated
toStringmethod now includes the new fields, which enhances the logging and debugging capabilities by providing a complete view of the request context.metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/BatchIngestionRunResource.java (2)
98-98: Review the usage of RequestContext in therollbackmethod.The addition of
RequestContextin therollbackmethod ensures that request-specific data is captured and logged, aligning with the PR objectives. This change enhances the traceability and auditability of requests.
174-174: Review the usage of RequestContext in thedescribemethod.The addition of
RequestContextin thedescribemethod ensures that request-specific data is captured and logged, aligning with the PR objectives. This change enhances the traceability and auditability of requests.metadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/GraphQLController.java (3)
62-63: Ensure proper handling ofHttpServletRequestin method signature.The addition of
HttpServletRequesttopostGraphQLis consistent with the PR's objectives to enhance logging and request handling. Ensure that therequestobject is properly utilized within the method and not causing any side effects.
132-132: Ensure proper logging ofqueryName.The logging of
queryNameprovides useful debugging information. Ensure that thequeryNameis correctly derived and represents meaningful information about the GraphQL query being executed.
121-128: Review the initialization ofSpringQueryContextwithHttpServletRequest.The new
SpringQueryContextinitialization now includes theHttpServletRequestobject. This change aligns with the PR's goal to enhance request context handling across different APIs. Verify that all properties from the request are correctly extracted and used within the context.metadata-service/openapi-servlet/src/test/java/entities/EntitiesControllerTest.java (1)
217-217: Review the use ofnullas the first parameter inpostEntities.Passing
nullas the first parameter in thepostEntitiesmethod call within a test could be intentional to test the handling ofnullvalues. However, ensure that this is explicitly documented or tested to avoid confusion and potential errors in future modifications.metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/EntityController.java (1)
Line range hint
91-111: Review the integration ofHttpServletRequestingetEntityBatch.The inclusion of
HttpServletRequestingetEntityBatchis consistent with the PR's objectives. Ensure that the request object is properly utilized to enhance the request context and logging capabilities.
[APROVED]metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/usage/UsageStats.java (1)
144-144: Ensure proper use ofRequestContext.builder().buildRestliinbatchIngest.The addition of
RequestContext.builder().buildRestliin thebatchIngestmethod is intended to enhance the request context. Ensure that the parameters passed tobuildRestliare correctly utilized and contribute to the improved logging and request handling.metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/operations/OperationsResource.java (1)
110-110: Review the implementation ofrestoreIndices.The new
restoreIndicesmethod utilizesUtils.restoreIndices, which should align with the PR's objectives of enhancing operations capabilities. Ensure that all parameters are correctly handled and the method functions as expected.metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v1/entities/EntitiesController.java (6)
94-94: Ensure proper handling ofHttpServletRequestin method parameters.The addition of
HttpServletRequest requestto the method parameters is consistent with the PR's goal to enhance logging capabilities. Ensure that this object is used securely and not exposed inappropriately in logs or error messages.
176-176: Review the integration ofHttpServletRequestin POST method.The addition of
HttpServletRequesttopostEntitiesallows for enhanced logging. Review the usage of this object within the method to ensure it's used securely, particularly in logging and error handling.
251-251: Review the integration ofHttpServletRequestin DELETE method.Adding
HttpServletRequesttodeleteEntitiessupports detailed logging. Ensure that the request object is not misused or exposed inappropriately, especially in error messages or logs.
199-200: Validate the correct usage ofHttpServletRequestin RequestContext building.The method
RequestContext.builder().buildOpenapi(...)now includes therequestobject. Confirm that this method securely extracts and logs necessary information from the request without exposing sensitive data.Verification successful
Validate the correct usage of
HttpServletRequestin RequestContext building.The
buildOpenapimethod in theRequestContextclass securely handles theHttpServletRequestobject by extracting the source IP and user agent, ensuring that sensitive data is not exposed. The relevant code snippet is:public RequestContext buildOpenapi( @Nonnull String actorUrn, @Nullable HttpServletRequest request, @Nonnull String action, @Nullable Collection<String> entityNames) { actorUrn(actorUrn); sourceIP(request == null ? "" : extractSourceIP(request)); requestAPI(RequestAPI.OPENAPI); requestID(buildRequestId(action, entityNames)); userAgent(request == null ? "" : extractUserAgent(request)); return build(); }
- Source IP:
sourceIP(request == null ? "" : extractSourceIP(request))- User Agent:
userAgent(request == null ? "" : extractUserAgent(request))These lines show that the method safely handles potential null values and extracts only necessary information.
Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Double-check security measures in the RequestContext's buildOpenapi method. # Test: Search for the method implementation. Expect: Security measures in place for handling 'request'. rg --type java $'public static RequestContext buildOpenapi'Length of output: 60
Script:
#!/bin/bash # Locate the RequestContext class and list its methods ast-grep --lang java --pattern 'class RequestContext { $$$ }' # Search for any references to buildOpenapi in the codebase rg 'buildOpenapi'Length of output: 4699
Script:
#!/bin/bash # Extract the implementation of the buildOpenapi method from the RequestContext class ast-grep --lang java --pattern 'public RequestContext buildOpenapi($_) { $$$ }' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 177
Script:
#!/bin/bash # List all methods in the RequestContext class to manually identify the buildOpenapi method ast-grep --lang java --pattern 'public $_ $_($_) { $$$ }' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 155
Script:
#!/bin/bash # Search for the buildOpenapi method definition in the RequestContext class file using rg rg 'public RequestContext buildOpenapi' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java -A 20Length of output: 1261
289-290: Check for secure handling ofHttpServletRequestin RequestContext construction.The method
RequestContext.builder().buildOpenapi(...)now incorporates therequestparameter. It is crucial to ensure that this integration does not lead to any security vulnerabilities, especially in the way IP addresses, user agents, and other sensitive headers are handled.Verification successful
Secure handling of
HttpServletRequestinRequestContextconstruction verified.The
buildOpenapimethod inRequestContextsecurely handles theHttpServletRequestparameter by extracting the source IP and user agent in a controlled manner:
- Source IP extraction: The
extractSourceIPmethod safely retrieves the IP address from theX-Forwarded-Forheader or falls back to the remote address if the header is not present.- User Agent extraction: The
extractUserAgentmethod retrieves the user agent from theUser-Agentheader, defaulting to an empty string if the header is absent.These methods ensure that sensitive headers are handled appropriately, mitigating potential security risks.
metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaScripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Confirm secure handling of HttpServletRequest in RequestContext construction. # Test: Search for the method implementation. Expect: Secure handling of sensitive headers. rg --type java $'public static RequestContext buildOpenapi'Length of output: 60
Script:
#!/bin/bash # Description: Locate all methods within the RequestContext class to find the correct method for further inspection. # Search for all methods in the RequestContext class ast-grep --lang java --pattern 'class RequestContext { $$$ }'Length of output: 63
Script:
#!/bin/bash # Description: Locate the file containing the RequestContext class definition. # Search for the RequestContext class definition in the repository rg --type java 'class RequestContext'Length of output: 335
Script:
#!/bin/bash # Description: Search for the buildOpenapi method within the RequestContext class file. # Search for the buildOpenapi method in the RequestContext.java file rg --type java 'buildOpenapi' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 232
Script:
#!/bin/bash # Description: Extract the full implementation of the buildOpenapi method from the RequestContext.java file. # Extract the buildOpenapi method implementation ast-grep --lang java --pattern 'public RequestContext buildOpenapi($_) { $$$ }' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 177
Script:
#!/bin/bash # Description: Search for all methods named buildOpenapi within the RequestContext.java file. # Search for all methods named buildOpenapi in the RequestContext.java file rg --type java 'buildOpenapi' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java -A 20Length of output: 1249
Script:
#!/bin/bash # Description: Extract the implementations of the extractSourceIP and extractUserAgent methods from the RequestContext.java file. # Extract the extractSourceIP method implementation rg --type java 'extractSourceIP' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java -A 10 # Extract the extractUserAgent method implementation rg --type java 'extractUserAgent' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java -A 10Length of output: 4094
127-128: Ensure the RequestContext is built correctly with the new request parameter.The
RequestContext.builder().buildOpenapi(...)method now includes therequestparameter, which should enhance the logging with request-specific details. Verify that thebuildOpenapimethod properly handles this parameter without leaking sensitive information.Verification successful
Ensure the
RequestContextis built correctly with the newrequestparameter.The
RequestContext.buildOpenapimethod properly handles therequestparameter by extracting the source IP and user agent, ensuring that the request-specific details are included in the context. Sensitive information such as the IP address and user agent are handled appropriately without exposing other potentially sensitive details.
RequestContext.buildOpenapimethod implementation:
sourceIPanduserAgentare derived from therequestparameter.- The method ensures that sensitive information is not leaked.
Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify that the RequestContext's buildOpenapi method handles the 'request' parameter securely. # Test: Search for the method implementation. Expect: Proper handling of the 'request' parameter. rg --type java $'public static RequestContext buildOpenapi'Length of output: 60
Script:
#!/bin/bash # Search for the RequestContext class definition to locate its file rg --files-with-matches 'class RequestContext' --type java # Once the file is located, search for all methods in the RequestContext class to find buildOpenapi rg --type java 'RequestContext' | xargs rg --type java 'buildOpenapi' # Search for invocations of RequestContext.builder() to track how the context is built rg --type java 'RequestContext.builder()'Length of output: 85727
Script:
#!/bin/bash # Fetch the implementation of the buildOpenapi method in the RequestContext class to verify the handling of the request parameter ast-grep --lang java --pattern 'public static RequestContext buildOpenapi($$$_)' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 523
Script:
#!/bin/bash # Search for the buildOpenapi method implementation in the RequestContext class using rg with a refined pattern rg --type java 'public static RequestContext buildOpenapi' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 156
Script:
#!/bin/bash # Search for all method definitions in the RequestContext class to identify any potential candidates rg --type java 'public static RequestContext' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 143
Script:
#!/bin/bash # Search for methods across the repository that include the request parameter and are related to OpenAPI rg --type java 'buildOpenapi'Length of output: 4647
Script:
#!/bin/bash # Extract and inspect the buildOpenapi method implementations from RequestContext.java to verify the handling of the request parameter rg -A 20 'public RequestContext buildOpenapi' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 1261
metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/AspectResource.java (2)
151-151: Ensure proper handling ofHttpServletRequestin method parameters.The addition of
HttpServletRequest requestto the method parameters is consistent with the PR's goal to enhance logging capabilities. Ensure that this object is used securely and not exposed inappropriately in logs or error messages.
202-202: Ensure the RequestContext is built correctly with the new request parameter.The
RequestContext.builder().buildRestli(...)method now includes therequestparameter, which should enhance the logging with request-specific details. Verify that thebuildRestlimethod properly handles this parameter without leaking sensitive information.Verification successful
Ensure the RequestContext is built correctly with the new request parameter.
The
RequestContext.builder().buildRestli(...)method now includes therequestparameter, which should enhance the logging with request-specific details. The verification shows that thebuildRestlimethod handles therequestparameter securely by extracting necessary details without leaking sensitive information.
- The
buildRestlimethod usesextractSourceIPandextractUserAgentmethods, which handle theresourceContextto gather specific and non-sensitive details.- The method then constructs the
RequestContextusing these details, ensuring no sensitive information is exposed.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify that the RequestContext's buildRestli method handles the 'request' parameter securely. # Test: Search for the method implementation. Expect: Proper handling of the 'request' parameter. rg --type java $'public static RequestContext buildRestli'Length of output: 59
Script:
#!/bin/bash # Step 1: Locate the RequestContext class file fd -e java -x grep -l 'class RequestContext' {} + # Step 2: Search for all methods in the RequestContext class fd -e java -x grep -A 10 -e 'class RequestContext' {} + | grep -A 10 -e 'public static RequestContext buildRestli'Length of output: 146430
Script:
#!/bin/bash # Step 1: Locate the RequestContext class file request_context_file=$(fd -e java 'RequestContext.java') # Step 2: Search for the buildRestli method within the RequestContext class file if [ -n "$request_context_file" ]; then grep -A 10 'public static RequestContext buildRestli' "$request_context_file" else echo "RequestContext.java file not found." fiLength of output: 413
Script:
#!/bin/bash # Step 1: Locate the RequestContext class file request_context_file=$(fd -e java 'RequestContext.java') # Step 2: List all static methods within the RequestContext class file if [ -n "$request_context_file" ]; then grep -E 'public static .* \w+\(' "$request_context_file" else echo "RequestContext.java file not found." fiLength of output: 392
Script:
#!/bin/bash # Search for the buildRestli method across the entire codebase rg --type java 'buildRestli'Length of output: 12104
Script:
#!/bin/bash # Step 1: Locate the RequestContext class file request_context_file=$(fd -e java 'RequestContext.java') # Step 2: Extract the buildRestli method implementations from the RequestContext class file if [ -n "$request_context_file" ]; then grep -A 20 'public RequestContext buildRestli' "$request_context_file" else echo "RequestContext.java file not found." fiLength of output: 1932
metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/operations/elastic/OperationsController.java (11)
34-34: Ensure proper handling ofHttpServletRequestin method parameters.The addition of
HttpServletRequest requestto the method parameters is consistent with the PR's goal to enhance logging capabilities. Ensure that this object is used securely and not exposed inappropriately in logs or error messages.
137-137: Review the integration ofHttpServletRequestin GET method.The addition of
HttpServletRequesttogetIndexSizesallows for enhanced logging. Review the usage of this object within the method to ensure it's used securely, particularly in logging and error handling.
175-175: Review the integration ofHttpServletRequestin EXPLAIN method.Adding
HttpServletRequesttoexplainSearchQuerysupports detailed logging. Ensure that the request object is not misused or exposed inappropriately, especially in error messages or logs.
269-269: Review the integration ofHttpServletRequestin EXPLAIN DIFF method.The addition of
HttpServletRequesttoexplainSearchQueryDiffallows for enhanced logging. Ensure that the request object is not misused or exposed inappropriately, especially in error messages or logs.
408-408: Review the integration ofHttpServletRequestin RESTORE INDICES method.Adding
HttpServletRequesttorestoreIndicessupports detailed logging. Ensure that the request object is not misused or exposed inappropriately, especially in error messages or logs.
456-456: Review the integration ofHttpServletRequestin RESTORE INDICES POST method.The addition of
HttpServletRequestto the POST version ofrestoreIndicesallows for enhanced logging. Review the usage of this object within the method to ensure it's used securely, particularly in logging and error handling.
428-429: Check for secure handling ofHttpServletRequestin RequestContext construction for RESTORE INDICES.The method
RequestContext.builder().buildOpenapi(...)now incorporates therequestparameter. It is crucial to ensure that this integration does not lead to any security vulnerabilities, especially in the way IP addresses, user agents, and other sensitive headers are handled.Verification successful
Secure handling of
HttpServletRequestverified inRequestContextconstruction for RESTORE INDICES.The
buildOpenapimethod inRequestContextsecurely handles theHttpServletRequestby extracting the source IP and user agent safely, ensuring that sensitive information is managed appropriately.
RequestContext.java:
sourceIP(request == null ? "" : extractSourceIP(request));userAgent(request == null ? "" : extractUserAgent(request));Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Confirm secure handling of HttpServletRequest in RequestContext construction for RESTORE INDICES. # Test: Search for the method implementation. Expect: Secure handling of sensitive headers. rg --type java $'public static RequestContext buildOpenapi'Length of output: 60
Script:
#!/bin/bash # Locate the usage of `RequestContext.builder()` and trace handling of `HttpServletRequest`. # Find all occurrences of `RequestContext.builder()` rg --type java 'RequestContext\.builder\(\)' # Find all methods related to `RequestContext` to understand its construction and handling of `HttpServletRequest` rg --type java 'class RequestContext' rg --type java 'RequestContext build'Length of output: 17133
Script:
#!/bin/bash # Extract the implementation details of the `buildOpenapi` method in the `RequestContext` class to verify secure handling of `HttpServletRequest`. # Locate the `buildOpenapi` method in the RequestContext class rg --type java 'public RequestContext buildOpenapi' --context 10Length of output: 4118
335-336: Validate the correct usage ofHttpServletRequestin RequestContext building for EXPLAIN DIFF.The method
RequestContext.builder().buildOpenapi(...)now includes therequestobject. Confirm that this method securely extracts and logs necessary information from the request without exposing sensitive data.Verification successful
Validate the correct usage of
HttpServletRequestinRequestContextbuilding for EXPLAIN DIFF.The
buildOpenapimethods in theRequestContextclass handle theHttpServletRequestobject securely by extracting the source IP and user agent, which are common practices for logging and request tracking. Sensitive data exposure is mitigated as only these specific request attributes are extracted.
metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaScripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Double-check security measures in the RequestContext's buildOpenapi method for EXPLAIN DIFF. # Test: Search for the method implementation. Expect: Security measures in place for handling 'request'. rg --type java $'public static RequestContext buildOpenapi'Length of output: 60
Script:
#!/bin/bash # Locate the RequestContext class definition and list all its methods to find the correct one. fd -t f -e java -x grep -Hn 'class RequestContext' {} \; | cut -d: -f1 | xargs -I {} sh -c 'echo "File: {}"; grep -n "{" {} | grep -B 1 "RequestContext"'Length of output: 922
Script:
#!/bin/bash # List all methods in the RequestContext class, including those in the RequestContextBuilder inner class. ast-grep --lang java --pattern 'class RequestContext { $$$ }' > methods_in_RequestContext.txt cat methods_in_RequestContext.txtLength of output: 101
Script:
#!/bin/bash # Search for method definitions within the RequestContext class file using rg. rg 'public .*RequestContext' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 536
Script:
#!/bin/bash # Extract the implementation of both buildOpenapi methods from the RequestContext class file. rg -A 20 'public RequestContext buildOpenapi' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 1261
234-235: Check for secure handling ofHttpServletRequestin RequestContext construction.The method
RequestContext.builder().buildOpenapi(...)now incorporates therequestparameter. It is crucial to ensure that this integration does not lead to any security vulnerabilities, especially in the way IP addresses, user agents, and other sensitive headers are handled.Verification successful
Secure handling of
HttpServletRequestverified.The methods
extractSourceIPandextractUserAgentinRequestContext.javasecurely handle theHttpServletRequestparameter:
extractSourceIP: Extracts the source IP from theX-Forwarded-Forheader or falls back to the remote address.extractUserAgent: Extracts the user agent from theUser-Agentheader, defaulting to an empty string if not present.No security vulnerabilities were found in the handling of sensitive headers.
metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java
- Lines: 142-144, 151-155
Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Confirm secure handling of HttpServletRequest in RequestContext construction. # Test: Search for the method implementation. Expect: Secure handling of sensitive headers. rg --type java $'public static RequestContext buildOpenapi'Length of output: 60
Script:
#!/bin/bash # Search for the definition of the `RequestContext` class and its methods, including `buildOpenapi` ast-grep --lang java --pattern 'class RequestContext { $$$ }' ast-grep --lang java --pattern 'public static RequestContext buildOpenapi($$$) { $$$ }'Length of output: 153
Script:
#!/bin/bash # Search for the definition of the `RequestContext` class rg --type java 'class RequestContext' # Search for any method containing `buildOpenapi` rg --type java 'buildOpenapi'Length of output: 4983
Script:
#!/bin/bash # Extract the implementation of the `buildOpenapi` method from `RequestContext.java` ast-grep --lang java --pattern 'public RequestContext buildOpenapi($$$) { $$$ }' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 2970
Script:
#!/bin/bash # Extract the implementations of `extractSourceIP` and `extractUserAgent` methods from `RequestContext.java` ast-grep --lang java --pattern 'private static String extractSourceIP($$$) { $$$ }' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java ast-grep --lang java --pattern 'private static String extractUserAgent($$$) { $$$ }' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 3176
471-472: Validate the correct usage ofHttpServletRequestin RequestContext building for RESTORE INDICES POST.The method
RequestContext.builder().buildOpenapi(...)now includes therequestobject. Confirm that this method securely extracts and logs necessary information from the request without exposing sensitive data.Verification successful
Validate the correct usage of
HttpServletRequestin RequestContext building for RESTORE INDICES POST.The
RequestContextclass'sbuildOpenapimethod securely handles theHttpServletRequestobject by extracting necessary information such as source IP and user agent through dedicated methods. The implementation ensures that sensitive information is not exposed, adhering to best practices for secure handling of HTTP requests.
RequestContext.javafile:
- Methods
extractSourceIPandextractUserAgentsafely extract required information fromHttpServletRequest.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Double-check security measures in the RequestContext's buildOpenapi method for RESTORE INDICES POST. # Test: Search for the method implementation. Expect: Security measures in place for handling 'request'. rg --type java $'public static RequestContext buildOpenapi'Length of output: 60
Script:
#!/bin/bash # Searching for the buildOpenapi method within the RequestContext class ast-grep --lang java --pattern $'class RequestContext { $$$ RequestContext buildOpenapi($_) { $$$ } $$$ }'Length of output: 121
Script:
#!/bin/bash # Searching for the buildOpenapi method across all Java files in the repository rg --type java 'buildOpenapi'Length of output: 4647
Script:
#!/bin/bash # Extracting the implementation of the buildOpenapi method from the RequestContext class ast-grep --lang java --pattern $'class RequestContext { $$$ public RequestContext buildOpenapi($_) { $$$ } $$$ }' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 224
Script:
#!/bin/bash # Displaying the content of RequestContext.java to locate and inspect the buildOpenapi method cat metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 6178
149-149: Validate the correct usage ofHttpServletRequestin RequestContext building.The method
RequestContext.builder().buildOpenapi(...)now includes therequestobject. Confirm that this method securely extracts and logs necessary information from the request without exposing sensitive data.Verification successful
Validation of
HttpServletRequestUsage inRequestContext.buildOpenapiThe
buildOpenapimethod inRequestContextsecurely handles theHttpServletRequestobject. The method uses theextractSourceIPandextractUserAgenthelper methods to retrieve specific information from the request without exposing sensitive data. These helper methods ensure that headers are safely extracted and default values are used when headers are missing.
extractSourceIPmethod:
- Retrieves the
X-Forwarded-Forheader and extracts the first IP address.- Falls back to
request.getRemoteAddr()if the header is not present.
extractUserAgentmethod:
- Retrieves the
User-Agentheader.- Returns an empty string if the header is not present.
These implementations confirm that the necessary security measures are in place when handling the
HttpServletRequestobject.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Double-check security measures in the RequestContext's buildOpenapi method. # Test: Search for the method implementation. Expect: Security measures in place for handling 'request'. rg --type java $'public static RequestContext buildOpenapi'Length of output: 60
Script:
#!/bin/bash # Search for the RequestContext class definition and list its methods to locate the buildOpenapi method. ast-grep --lang java --pattern 'class RequestContext { $$$ }' --debugLength of output: 289
Script:
#!/bin/bash # Search for the RequestContext class definition and list its methods to locate the buildOpenapi method. ast-grep --lang java --pattern 'class RequestContext { $$$ }'Length of output: 63
Script:
#!/bin/bash # Search for files containing the term 'RequestContext' and then inspect those files for the 'buildOpenapi' method. rg 'RequestContext' --files-with-matches | xargs rg 'buildOpenapi'Length of output: 4682
Script:
#!/bin/bash # Extract the implementation of the buildOpenapi method from RequestContext.java ast-grep --lang java --pattern 'public RequestContext buildOpenapi($_, $_, $_, $_) { $$$ }' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 670
Script:
#!/bin/bash # Search for the buildOpenapi method signature in RequestContext.java rg 'public RequestContext buildOpenapi' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java -A 20Length of output: 1261
Script:
#!/bin/bash # Extract the implementations of extractSourceIP and extractUserAgent methods from RequestContext.java rg 'private static String extractSourceIP' -A 10 metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java rg 'private static String extractUserAgent' -A 10 metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 1648
metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/controller/GenericEntitiesController.java (13)
55-55: Ensure proper handling ofHttpServletRequestin method parameters.The addition of
HttpServletRequest requestto the method parameters is consistent with the PR's goal to enhance logging capabilities. Ensure that this object is used securely and not exposed inappropriately in logs or error messages.
137-137: Review the integration ofHttpServletRequestin GET method.The addition of
HttpServletRequesttogetEntitiesallows for enhanced logging. Review the usage of this object within the method to ensure it's used securely, particularly in logging and error handling.
206-206: Review the integration ofHttpServletRequestin GET ENTITY method.Adding
HttpServletRequesttogetEntitysupports detailed logging. Ensure that the request object is not misused or exposed inappropriately, especially in error messages or logs.
249-249: Review the integration ofHttpServletRequestin HEAD ENTITY method.The addition of
HttpServletRequesttoheadEntityallows for enhanced logging. Review the usage of this object within the method to ensure it's used securely, particularly in logging and error handling.
283-283: Review the integration ofHttpServletRequestin GET ASPECT method.Adding
HttpServletRequesttogetAspectsupports detailed logging. Ensure that the request object is not misused or exposed inappropriately, especially in error messages or logs.
327-327: Review the integration ofHttpServletRequestin HEAD ASPECT method.The addition of
HttpServletRequesttoheadAspectallows for enhanced logging. Review the usage of this object within the method to ensure it's used securely, particularly in logging and error handling.
360-360: Review the integration ofHttpServletRequestin DELETE ENTITY method.Adding
HttpServletRequesttodeleteEntitysupports detailed logging. Ensure that the request object is not misused or exposed inappropriately, especially in error messages or logs.
376-378: Check for secure handling ofHttpServletRequestin RequestContext construction for DELETE ENTITY.The method
RequestContext.builder().buildOpenapi(...)now incorporates therequestparameter. It is crucial to ensure that this integration does not lead to any security vulnerabilities, especially in the way IP addresses, user agents, and other sensitive headers are handled.Verification successful
Confirm secure handling of
HttpServletRequestinRequestContextconstruction for DELETE ENTITY.The methods
extractUserAgentandextractSourceIPfromRequestContexthandle sensitive headers by safely extracting theUser-Agentand source IP address. Here are the relevant implementations:
extractUserAgent:private static String extractUserAgent(@Nonnull HttpServletRequest request) { return Optional.ofNullable(request.getHeader(HttpHeaders.USER_AGENT)).orElse(""); }
extractSourceIP:private static String extractSourceIP(@Nonnull HttpServletRequest request) { return Optional.ofNullable(request.getHeader(HttpHeaders.X_FORWARDED_FOR)) .map(xForward -> xForward.split(",")[0]) .orElse(request.getRemoteAddr()); }These methods ensure that sensitive headers are handled securely by using
Optionalto avoidNullPointerExceptionand properly parsing theX-Forwarded-Forheader to get the correct IP address.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Confirm secure handling of HttpServletRequest in RequestContext construction for DELETE ENTITY. # Test: Search for the method implementation. Expect: Secure handling of sensitive headers. rg --type java $'public static RequestContext buildOpenapi'Length of output: 60
Script:
#!/bin/bash # Searching for the buildOpenapi method within the codebase, without assumptions about its visibility or static nature. rg 'buildOpenapi' # Searching for any usages of HttpServletRequest within RequestContext to ensure secure handling of sensitive headers. rg 'HttpServletRequest' --type javaLength of output: 30681
Script:
#!/bin/bash # Extracting the implementation of the buildOpenapi method and related methods handling HttpServletRequest in RequestContext.java ast-grep --lang java --pattern 'public RequestContext buildOpenapi($_$) { $$$ }' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java # Extracting the implementation of the extractUserAgent method in RequestContext.java ast-grep --lang java --pattern 'private static String extractUserAgent(@Nonnull HttpServletRequest request) { $$$ }' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java # Extracting the implementation of the extractSourceIP method in RequestContext.java ast-grep --lang java --pattern 'private static String extractSourceIP(@Nonnull HttpServletRequest request) { $$$ }' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 1846
164-166: Validate the correct usage ofHttpServletRequestin RequestContext building.The method
RequestContext.builder().buildOpenapi(...)now includes therequestobject. Confirm that this method securely extracts and logs necessary information from the request without exposing sensitive data.Verification successful
Validate the correct usage of
HttpServletRequestin RequestContext building.The
extractSourceIPandextractUserAgentmethods securely handle theHttpServletRequestobject. They extract the source IP and user agent from the request headers without exposing sensitive data.
extractSourceIP: Retrieves the source IP from theX-Forwarded-Forheader or falls back togetRemoteAddr().extractUserAgent: Retrieves the user agent from theUser-Agentheader or returns an empty string if the header is not present.These implementations ensure that no sensitive data is exposed.
Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Double-check security measures in the RequestContext's buildOpenapi method. # Test: Search for the method implementation. Expect: Security measures in place for handling 'request'. rg --type java $'public static RequestContext buildOpenapi'Length of output: 60
Script:
#!/bin/bash # Locate the RequestContext class file fd 'RequestContext.java' # Search for the buildOpenapi method within the located file fd 'RequestContext.java' | xargs rg 'buildOpenapi'Length of output: 276
Script:
#!/bin/bash # Extract the implementation of the buildOpenapi method from RequestContext.java rg -A 20 'public RequestContext buildOpenapi' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 1261
Script:
#!/bin/bash # Search for the implementations of extractSourceIP and extractUserAgent methods in RequestContext.java rg 'extractSourceIP' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java rg 'extractUserAgent' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 952
Script:
#!/bin/bash # Extract the implementations of extractSourceIP and extractUserAgent methods from RequestContext.java rg -A 10 'private static String extractSourceIP' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java rg -A 10 'private static String extractUserAgent' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 1648
225-227: Check for secure handling ofHttpServletRequestin RequestContext construction for GET ENTITY.The method
RequestContext.builder().buildOpenapi(...)now incorporates therequestparameter. It is crucial to ensure that this integration does not lead to any security vulnerabilities, especially in the way IP addresses, user agents, and other sensitive headers are handled.Verification successful
Check for secure handling of
HttpServletRequestin RequestContext construction for GET ENTITY.The methods
extractSourceIPandextractUserAgentare used to handle sensitive headers from theHttpServletRequest. These methods appear to safely extract and handle the necessary information by using optional checks and default values. Therefore, the integration ofHttpServletRequestin theRequestContextconstruction seems secure.
extractSourceIPmethod:
- Uses
Optional.ofNullableto safely handle theX_FORWARDED_FORheader.- Falls back to
request.getRemoteAddr()if the header is not present.
extractUserAgentmethod:
- Uses
Optional.ofNullableto safely handle theUSER_AGENTheader.- Provides an empty string as a default value if the header is not present.
Verified Locations:
metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaScripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Confirm secure handling of HttpServletRequest in RequestContext construction for GET ENTITY. # Test: Search for the method implementation. Expect: Secure handling of sensitive headers. rg --type java $'public static RequestContext buildOpenapi'Length of output: 60
Script:
#!/bin/bash # Description: Locate the RequestContext class and inspect its methods to verify secure handling of HttpServletRequest. # Search for the RequestContext class definition ast-grep --lang java --pattern 'class RequestContext { $$$ }' # Search for methods within the RequestContext class that handle HttpServletRequest rg --type java --pattern 'RequestContext buildOpenapi' --context 10Length of output: 545
Script:
#!/bin/bash # Description: Locate the RequestContext class and inspect its methods to verify secure handling of HttpServletRequest. # Search for the RequestContext class definition ast-grep --lang java --pattern 'class RequestContext { $$$ }' # Correct usage of rg to search for methods within the RequestContext class that handle HttpServletRequest rg 'RequestContext buildOpenapi' --type java --context 10Length of output: 4175
Script:
#!/bin/bash # Description: Verify secure handling in extractSourceIP and extractUserAgent methods. # Search for the implementation of extractSourceIP method rg 'extractSourceIP' --type java --context 10 # Search for the implementation of extractUserAgent method rg 'extractUserAgent' --type java --context 10Length of output: 22722
265-267: Validate the correct usage ofHttpServletRequestin RequestContext building for HEAD ENTITY.The method
RequestContext.builder().buildOpenapi(...)now includes therequestobject. Confirm that this method securely extracts and logs necessary information from the request without exposing sensitive data.Verification successful
The
buildOpenapimethod inRequestContextsecurely handles theHttpServletRequestobject.The method extracts the source IP and user agent from the
requestobject, which are common practices for logging and auditing. There is no indication that sensitive data is exposed inappropriately.
metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaScripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Double-check security measures in the RequestContext's buildOpenapi method for HEAD ENTITY. # Test: Search for the method implementation. Expect: Security measures in place for handling 'request'. rg --type java $'public static RequestContext buildOpenapi'Length of output: 60
Script:
#!/bin/bash # Search for the buildOpenapi method within the RequestContext class ast-grep --lang java --pattern 'class RequestContext { $$$ public static RequestContext buildOpenapi($_, $_, $_, $_) { $$$ } $$$ }'Length of output: 133
Script:
#!/bin/bash # Search for all occurrences of buildOpenapi in the codebase to locate the method definition and its usage rg 'buildOpenapi'Length of output: 4635
Script:
#!/bin/bash # Retrieve the full implementation of the buildOpenapi method from RequestContext.java rg -A 20 'public RequestContext buildOpenapi' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 1261
301-303: Check for secure handling ofHttpServletRequestin RequestContext construction for GET ASPECT.The method
RequestContext.builder().buildOpenapi(...)now incorporates therequestparameter. It is crucial to ensure that this integration does not lead to any security vulnerabilities, especially in the way IP addresses, user agents, and other sensitive headers are handled.Verification successful
Secure handling of
HttpServletRequestinRequestContextmethods verified.The methods
extractUserAgentandextractSourceIPwithin theRequestContextclass handleHttpServletRequestsecurely by usingOptional.ofNullableto handle the headers. This ensures that null values are managed appropriately, and sensitive headers are processed safely.
extractUserAgent: Retrieves theUser-Agentheader and defaults to an empty string if not present.extractSourceIP: Retrieves theX-Forwarded-Forheader and falls back to the remote address if the header is not present.These implementations show secure handling of sensitive headers, mitigating potential vulnerabilities.
Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Confirm secure handling of HttpServletRequest in RequestContext construction for GET ASPECT. # Test: Search for the method implementation. Expect: Secure handling of sensitive headers. rg --type java $'public static RequestContext buildOpenapi'Length of output: 60
Script:
#!/bin/bash # Description: Locate the RequestContext class and ensure secure handling of HttpServletRequest in the buildOpenapi method. # Find the file containing the RequestContext class request_context_file=$(rg --files-with-matches --type java 'class RequestContext') # Search for the buildOpenapi method within the found file if [ -n "$request_context_file" ]; then rg --type java --no-filename 'public static RequestContext buildOpenapi' $request_context_file fiLength of output: 460
Script:
#!/bin/bash # Description: Search for methods in RequestContext class that handle HttpServletRequest to ensure secure handling. # Search for method signatures that take HttpServletRequest as a parameter in the RequestContext class rg --type java --no-filename 'public static RequestContext .*HttpServletRequest' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 178
Script:
#!/bin/bash # Description: Broaden search to find any method in RequestContext class that involves HttpServletRequest indirectly. # Search for any method in the RequestContext class that involves HttpServletRequest indirectly rg --type java --no-filename 'HttpServletRequest' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 492
Script:
#!/bin/bash # Description: Extract the implementation of extractUserAgent and extractSourceIP methods to ensure secure handling of HttpServletRequest. # Extract the implementation of extractUserAgent and extractSourceIP methods rg --type java --no-filename -A 10 'private static String extractUserAgent' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java rg --type java --no-filename -A 10 'private static String extractSourceIP' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 1700
344-346: Validate the correct usage ofHttpServletRequestin RequestContext building for HEAD ASPECT.The method
RequestContext.builder().buildOpenapi(...)now includes therequestobject. Confirm that this method securely extracts and logs necessary information from the request without exposing sensitive data.Verification successful
Validate the correct usage of
HttpServletRequestin RequestContext building for HEAD ASPECT.The
buildOpenapimethod in theRequestContextclass securely extracts the source IP and user agent from theHttpServletRequestobject. The methodsextractSourceIPandextractUserAgenthandle the request headers properly, ensuring no sensitive data is exposed.
- File:
metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java
buildOpenapimethod implementation:public RequestContext buildOpenapi( @Nonnull String actorUrn, @Nullable HttpServletRequest request, @Nonnull String action, @Nullable Collection<String> entityNames) { actorUrn(actorUrn); sourceIP(request == null ? "" : extractSourceIP(request)); requestAPI(RequestAPI.OPENAPI); requestID(buildRequestId(action, entityNames)); userAgent(request == null ? "" : extractUserAgent(request)); return build(); }extractSourceIPmethod implementation:private static String extractSourceIP(@Nonnull HttpServletRequest request) { return Optional.ofNullable(request.getHeader(HttpHeaders.X_FORWARDED_FOR)) .map(xForward -> xForward.split(",")[0]) .orElse(request.getRemoteAddr()); }extractUserAgentmethod implementation:private static String extractUserAgent(@Nonnull HttpServletRequest request) { return Optional.ofNullable(request.getHeader(HttpHeaders.USER_AGENT)).orElse(""); }Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Double-check security measures in the RequestContext's buildOpenapi method for HEAD ASPECT. # Test: Search for the method implementation. Expect: Security measures in place for handling 'request'. rg --type java $'public static RequestContext buildOpenapi'Length of output: 60
Script:
#!/bin/bash # Locate the RequestContext class definition ast-grep --lang java --pattern 'class RequestContext { $$$ }' # Locate the buildOpenapi method within the RequestContext class ast-grep --lang java --pattern 'public static RequestContext buildOpenapi($$$_)' | xargs -I {} sh -c 'echo "File: {}" && cat {}'Length of output: 541
Script:
#!/bin/bash # Locate the RequestContext class definition rg --type java 'class RequestContext' # Locate methods within the RequestContext class rg --type java 'RequestContext' | xargs -I {} sh -c 'echo "File: {}" && rg --type java "public static RequestContext" {}'Length of output: 35859
Script:
#!/bin/bash # Search for the buildOpenapi method within the RequestContext class file rg --type java 'buildOpenapi' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 232
Script:
#!/bin/bash # Extract the full implementation of the buildOpenapi method from the RequestContext class file rg --type java -A 20 'public RequestContext buildOpenapi' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 1273
Script:
#!/bin/bash # Extract the implementations of the extractSourceIP and extractUserAgent methods from the RequestContext class file rg --type java -A 20 'extractSourceIP|extractUserAgent' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 3649
metadata-service/openapi-entity-servlet/src/main/java/io/datahubproject/openapi/v2/delegates/EntityApiDelegateImpl.java (11)
Line range hint
89-106: Constructor Update: Proper Initialization of HttpServletRequestThe addition of
HttpServletRequestto the constructor and its subsequent assignment to the class fieldthis.requestis correctly implemented. This change aligns with the PR's objective to enhance logging and context management by making request data available to API methods.
126-126: Enhanced Request Logging ingetMethodThe inclusion of the
requestparameter in_v1Controller.getEntitiescall is appropriate and aligns with the PR's objectives. This ensures that request-specific data is available for logging and context management.
153-153: Correct Usage of HttpServletRequest increateMethodThe inclusion of the
requestparameter in_v1Controller.postEntitiesis correctly implemented and aligns with the PR's objectives for enhanced request logging and context management.
165-165: Proper Inclusion of HttpServletRequest indeleteMethodThe method correctly includes the
requestparameter in_v1Controller.deleteEntities, ensuring that request-specific data is available for enhanced logging and context management.
184-186: Enhanced Context Management inheadMethodThe method correctly constructs a
RequestContextusing therequestparameter, ensuring that request-specific data is accurately captured for logging and context management.
209-209: Correct Implementation of HttpServletRequest ingetAspectMethodThe inclusion of the
requestparameter in_v1Controller.getEntitiesensures that request-specific data is available for enhanced logging and context management.
226-226: Proper Usage of HttpServletRequest increateAspectMethodThe inclusion of the
requestparameter in_v1Controller.postEntitiesis correctly implemented and aligns with the PR's objectives for enhanced request logging and context management.
248-250: Enhanced Context Management inheadAspectMethodThe method correctly constructs a
RequestContextusing therequestparameter, ensuring that request-specific data is accurately captured for logging and context management.
271-273: Correct Construction of RequestContext indeleteAspectMethodThe method correctly constructs a
RequestContextusing therequestparameter, ensuring that request-specific data is accurately captured for logging and context management.
620-622: Enhanced Context Management inscrollMethodThe method correctly constructs a
RequestContextusing therequestparameter, ensuring that request-specific data is accurately captured for logging and context management.
660-660: Correct Implementation of HttpServletRequest ingetEntitiesMethodThe inclusion of the
requestparameter in_v1Controller.getEntitiesensures that request-specific data is available for enhanced logging and context management.metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.java (22)
664-664: Reviewlistmethod for appropriate RequestContext setup.Ensure that the
ACTION_LISTused inRequestContextis correctly implemented and that all parameters are logged as expected.Verification successful
Ensure
ACTION_LISTis correctly set up inRequestContextThe
ACTION_LISTis defined asprivate static final String ACTION_LIST = "list";and is used appropriately in theRequestContextsetup. All parameters are logged as expected.
ACTION_LISTis correctly defined and used within theRequestContext.builder().buildRestlimethod.- Logging statements related to
RequestContextinitializations are present and cover various actions includingACTION_LIST.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the correct usage of `ACTION_LIST` in RequestContext. # Test: Search for `ACTION_LIST` in the logging statements within RequestContext initializations. rg --type java 'RequestContext.*ACTION_LIST' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 490
Script:
#!/bin/bash # Description: Search for the definition and implementation of `ACTION_LIST` and inspect the logging statements related to `RequestContext` initializations. # Search for the definition of `ACTION_LIST` rg --type java 'ACTION_LIST' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.java # Search for logging statements in `RequestContext` initializations rg --type java 'RequestContext.builder' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 4846
782-782: EvaluategetBrowsePathsfor correct RequestContext setup.Ensure that the
ACTION_GET_BROWSE_PATHSused inRequestContextis appropriate for the operation and that all parameters are logged correctly.Verification successful
RequestContext setup for
getBrowsePathsis correct.The
ACTION_GET_BROWSE_PATHSis appropriately used in theRequestContextsetup, and the parameters are logged correctly withinEntityResource.java.
EntityResource.java:log.info("GET BROWSE PATHS for {}", urn);Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the logging for `ACTION_GET_BROWSE_PATHS` in RequestContext. # Test: Search for `ACTION_GET_BROWSE_PATHS` in the logging statements within RequestContext initializations. rg --type java 'RequestContext.*ACTION_GET_BROWSE_PATHS' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 362
Script:
#!/bin/bash # Searching for all instances of RequestContext initialization to understand its usage rg --type java 'RequestContext.builder' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/ # Searching for logging statements that might include RequestContext or ACTION_GET_BROWSE_PATHS rg --type java 'log' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/Length of output: 14842
851-851: CheckdeleteAllaction in RequestContext for accuracy.Verify that the
deleteAllaction used inRequestContextis correctly implemented, ensuring it meets the logging and security requirements outlined in the PR.
902-902: AssessdeleteEntityfor correct RequestContext handling.The
RequestContextis built withACTION_DELETE. It's crucial to ensure that this action is correctly logged and the parameters are handled securely.Verification successful
RequestContext handling and logging for
ACTION_DELETEis verified.The
RequestContextlogs the constructed context details uniformly across APIs in its constructor, ensuring that the action and parameters are logged securely.
- The
RequestContextclass handles parameters such asactorUrn,sourceIP,requestAPI,requestID, anduserAgentsecurely.- The centralized logging in the
RequestContextconstructor ensures thatACTION_DELETEis logged appropriately.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the logging for `ACTION_DELETE` in RequestContext. # Test: Search for logging statements related to `ACTION_DELETE` in RequestContext initializations. rg --type java 'RequestContext.*ACTION_DELETE' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 334
Script:
#!/bin/bash # Description: Verify logging statements and secure handling of RequestContext with ACTION_DELETE in EntityResource and RequestContext classes. # 1. Search for logging statements in EntityResource.java rg --type java 'log' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.java # 2. Search for the definition of the RequestContext class to inspect its handling of parameters. fd 'RequestContext.java' --exec catLength of output: 7187
243-243: Review the usage ofbatchGetRequestContext parameters.The
RequestContextis built withbatchGetas the API operation. Ensure this aligns with the intended usage and that the parameters are being logged as expected.Verification successful
Logging for
batchGetRequestContext parameters is in place and aligns with the intended usage.
log.info("BATCH GET {}", urnStrs);confirms that thebatchGetparameters are being logged as expected.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the logging for `batchGet` operation in RequestContext. # Test: Search for logging statements related to `batchGet` in RequestContext initializations. rg --type java 'RequestContext.*batchGet' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 495
Script:
#!/bin/bash # Description: Verify logging for `RequestContext` parameters related to `batchGet`. # Test: Search for logging statements involving `RequestContext` parameters, specifically for `batchGet`. rg --type java 'log.*RequestContext.*batchGet' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 158
Script:
#!/bin/bash # Description: Search for all logging statements in the EntityResource.java file. # Test: Search for all logging statements in the file. rg --type java 'log' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 1074
203-203: Ensure appropriate logging for RequestContext creation ingetmethod.The
RequestContextis built with therestrictedServiceparameter. Verify that this is intended and correctly logs the necessary information as per the PR's objectives.
705-705: Checkautocompletefor correct RequestContext implementation.The
RequestContextis built withACTION_AUTOCOMPLETE. Verify that this action is correctly logged and the parameters are handled securely.
1148-1148: CheckapplyRetentionfor correct RequestContext implementation.The
RequestContextis built withACTION_APPLY_RETENTION. Verify that this action is correctly logged and the parameters are handled securely.
609-609: AssessscrollAcrossLineagefor correct RequestContext handling.The
RequestContextis built withACTION_SCROLL_ACROSS_LINEAGE. Verify that this is correctly implemented and aligns with the intended logging and security practices.
337-337: Validate thebatchIngestaction in RequestContext.Ensure that the
ACTION_BATCH_INGESTused inRequestContextis appropriate for the operation and that all parameters are logged correctly.Verification successful
Validate the
batchIngestaction in RequestContext.The
ACTION_BATCH_INGESTis defined as "batchIngest" and is used appropriately inRequestContext.builder().buildRestli. TheRequestContextclass includes uniform logging of requests across APIs, which ensures that all parameters are logged correctly when aRequestContextis created.
RequestContextlogs all its parameters in the constructor vialog.info(toString()).Therefore, the
ACTION_BATCH_INGESTusage and parameter logging are validated.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Check the usage and logging of `ACTION_BATCH_INGEST` in RequestContext. # Test: Search for `ACTION_BATCH_INGEST` in the logging statements within RequestContext initializations. rg --type java 'RequestContext.*ACTION_BATCH_INGEST' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 323
Script:
#!/bin/bash # Description: Check the definition of `ACTION_BATCH_INGEST` and logging statements in RequestContext. # Search for the definition of `ACTION_BATCH_INGEST` rg --type java 'ACTION_BATCH_INGEST' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/ # Search for logging statements in RequestContext rg --type java 'RequestContext' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/Length of output: 10988
Script:
#!/bin/bash # Description: Check logging statements related to RequestContext in the entire codebase. # Search for logging statements in the entire codebase that involve RequestContext rg --type java 'RequestContext.*log'Length of output: 38
Script:
#!/bin/bash # Description: Inspect the RequestContext class for any logging methods. # Locate and display the RequestContext class definition to check for logging methods rg --files-with-matches 'class RequestContext' | xargs catLength of output: 6137
1065-1065: ReviewgetTotalEntityCountmethod for appropriate RequestContext setup.Ensure that the
getTotalEntityCountused inRequestContextis correctly implemented and that all parameters are logged as expected.Verification successful
Review
getTotalEntityCountmethod for appropriate RequestContext setup.The
RequestContextclass handles thegetTotalEntityCountmethod correctly, and parameters are logged as expected usinglog.info(toString()). No further action is required.
RequestContextclass definition and methods:metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java- Logging within
RequestContext:log.info(toString())Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the correct usage of `getTotalEntityCount` in RequestContext. # Test: Search for `getTotalEntityCount` in the logging statements within RequestContext initializations. rg --type java 'RequestContext.*getTotalEntityCount' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 347
Script:
#!/bin/bash # Find the RequestContext class definition. ast-grep --lang java --pattern 'class RequestContext { $$$ }' # Search for methods within the RequestContext class that handle the 'getTotalEntityCount' parameter. rg --type java 'getTotalEntityCount' $(fd RequestContext.java)Length of output: 222
Script:
#!/bin/bash # Find the RequestContext class definition and its methods. rg --type java 'class RequestContext' -A 20 rg --type java 'RequestContext' $(fd .java) # Search for logging statements within the RequestContext class. rg --type java 'log' $(fd RequestContext.java)Length of output: 255671
1106-1106: EvaluatelistUrnsfor correct RequestContext setup.Ensure that the
ACTION_LIST_URNSused inRequestContextis appropriate for the operation and that all parameters are logged correctly.Verification successful
ACTION_LIST_URNSis appropriately used in theRequestContextsetup.The constant
ACTION_LIST_URNSis correctly defined and used within theRequestContextsetup. All parameters are logged correctly.
metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaScripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the logging for `ACTION_LIST_URNS` in RequestContext. # Test: Search for `ACTION_LIST_URNS` in the logging statements within RequestContext initializations. rg --type java 'RequestContext.*ACTION_LIST_URNS' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 331
Script:
#!/bin/bash # Description: Locate the RequestContext class and inspect its methods for handling ACTION_LIST_URNS. # Find the RequestContext class definition. fd -e java 'RequestContext' | xargs rg 'class RequestContext' # Search for methods in RequestContext that handle ACTION_LIST_URNS. rg --type java 'ACTION_LIST_URNS' $(fd -e java 'RequestContext')Length of output: 324
Script:
#!/bin/bash # Description: Inspect the RequestContextBuilder and buildRestli methods in RequestContext for handling ACTION_LIST_URNS. # Search for the RequestContextBuilder class and its buildRestli method. rg --type java 'class RequestContextBuilder' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java rg --type java 'buildRestli' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java # Search for ACTION_LIST_URNS usage within the RequestContextBuilder class and buildRestli method. rg --type java 'ACTION_LIST_URNS' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 612
Script:
#!/bin/bash # Description: Locate the definition of ACTION_LIST_URNS in the codebase. # Search for the definition of ACTION_LIST_URNS. rg --type java 'ACTION_LIST_URNS'Length of output: 820
1174-1174: Inspectfilterfor correct RequestContext usage.The
RequestContextsetup forfilterusesACTION_FILTER. Confirm that this is used correctly and aligns with the intended logging and security practices.Verification successful
Inspect
filterfor correct RequestContext usage.The
RequestContextsetup forfilterusesACTION_FILTERcorrectly. It aligns with the intended logging and security practices by ensuring user authorization and logging filter results.
EntityResource.java:
filtermethod: Lines 1170-1190Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Check the usage of `ACTION_FILTER` in RequestContext. # Test: Search for `ACTION_FILTER` in the logging statements within RequestContext initializations. rg --type java 'RequestContext.*ACTION_FILTER' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 325
Script:
#!/bin/bash # Description: Check the definition and usage of `ACTION_FILTER` in the codebase. # Search for the definition of `ACTION_FILTER` rg --type java 'ACTION_FILTER' # Search for the usage of `ACTION_FILTER` within RequestContext class rg --type java 'ACTION_FILTER' --context 5Length of output: 6088
Script:
#!/bin/bash # Description: Extract the implementation of the `filter` method from the `EntityResource` class to review logging and security practices. # Extract the `filter` method implementation ast-grep --lang java --pattern $'public Task<SearchResult> filter($_, $_, $_, $_, $_, $_) { $$$ }' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 700
Script:
#!/bin/bash # Description: Extract the implementation of the `filter` method from the `EntityResource` class using ripgrep to review logging and security practices. # Search for the `filter` method declaration and extract its surrounding lines rg --type java -A 30 'public Task<SearchResult> filter' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 1701
1020-1020: InspectdeleteReferencesfor correct RequestContext usage.The
RequestContextsetup fordeleteReferencesusesdeleteReferences. Confirm that this is used correctly and aligns with the intended logging and security practices.Verification successful
Inspect
deleteReferencesfor correct RequestContext usage.The
RequestContextsetup fordeleteReferencesusesdeleteReferencesin a manner consistent with other actions. The fieldsrequestID,sourceIP, anduserAgentare correctly populated and utilized, aligning with the intended logging and security practices.
RequestContext.java: ThebuildRestlimethod initializes context fields appropriately.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Check the usage of `deleteReferences` in RequestContext. # Test: Search for `deleteReferences` in the logging statements within RequestContext initializations. rg --type java 'RequestContext.*deleteReferences' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 342
Script:
#!/bin/bash # Search for the definition and usage of RequestContext in the codebase rg --type java 'class RequestContext' rg --type java 'RequestContext'Length of output: 38197
Script:
#!/bin/bash # Search for the buildRestli method in RequestContext.java to inspect its implementation rg --type java 'buildRestli' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 293
Script:
#!/bin/bash # Extract the full implementation of the buildRestli method from RequestContext.java rg --type java -A 10 'public RequestContext buildRestli' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 1365
Script:
#!/bin/bash # Search for the usage of requestID, sourceIP, and userAgent within RequestContext.java rg --type java 'requestID|sourceIP|userAgent' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 1321
437-437: EvaluatesearchAcrossEntitiesfor correct RequestContext usage.The
RequestContextsetup forsearchAcrossEntitiesusesACTION_SEARCH_ACROSS_ENTITIES. Confirm that this is used correctly and aligns with the intended logging and security practices.Verification successful
Correct usage of
ACTION_SEARCH_ACROSS_ENTITIESinRequestContextconfirmed.The
ACTION_SEARCH_ACROSS_ENTITIESis correctly used in theRequestContextsetup, aligning with logging and security practices. ThebuildRestlimethod handles the action parameter appropriately, setting necessary fields for logging and security.
RequestContextclass:metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javabuildRestlimethod implementationScripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Check the usage of `ACTION_SEARCH_ACROSS_ENTITIES` in RequestContext. # Test: Search for `ACTION_SEARCH_ACROSS_ENTITIES` in RequestContext initializations. rg --type java 'RequestContext.*ACTION_SEARCH_ACROSS_ENTITIES' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 354
Script:
#!/bin/bash # Locate the definition of ACTION_SEARCH_ACROSS_ENTITIES rg 'ACTION_SEARCH_ACROSS_ENTITIES' --type java # Check other usages of ACTION_SEARCH_ACROSS_ENTITIES in the codebase rg 'ACTION_SEARCH_ACROSS_ENTITIES' --type javaLength of output: 1381
Script:
#!/bin/bash # Locate the RequestContext class implementation rg 'class RequestContext' --type java # Check for methods handling actions within RequestContext rg 'ACTION_SEARCH_ACROSS_ENTITIES' --type javaLength of output: 1026
Script:
#!/bin/bash # Inspect the RequestContext class for the buildRestli method and related logging and security handling rg 'buildRestli' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java # Check for logging and security handling within RequestContext rg 'log' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java rg 'security' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 677
Script:
#!/bin/bash # Retrieve the implementation details of the buildRestli method in RequestContext class rg 'public RequestContext buildRestli' -A 20 metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 1668
550-550: ChecksearchAcrossLineagefor appropriate RequestContext setup.Ensure that the
ACTION_SEARCH_ACROSS_LINEAGEused inRequestContextis appropriate and that all parameters are logged as per the PR's objectives.Verification successful
Check
searchAcrossLineagefor appropriate RequestContext setup.The
RequestContextclass includes atoStringmethod that logs key parameters such asactorUrn,sourceIP,requestAPI,requestID, anduserAgent. TheACTION_SEARCH_ACROSS_LINEAGEis passed as theactionparameter to thebuildRestlimethod, which is used to construct therequestID. Therefore, all relevant parameters, includingACTION_SEARCH_ACROSS_LINEAGE, are appropriately logged.
RequestContextclass:metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java- Logging statement:
log.info(toString());Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the logging for `ACTION_SEARCH_ACROSS_LINEAGE` in RequestContext. # Test: Search for `ACTION_SEARCH_ACROSS_LINEAGE` in the logging statements within RequestContext initializations. rg --type java 'RequestContext.*ACTION_SEARCH_ACROSS_LINEAGE' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 360
Script:
#!/bin/bash # Find the definition of the RequestContext class and its usage of ACTION_SEARCH_ACROSS_LINEAGE ast-grep --lang java --pattern 'class RequestContext { $$$ }' # Search for logging statements within the RequestContext class rg --type java 'log' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/RequestContext.javaLength of output: 344
Script:
#!/bin/bash # Locate the RequestContext class file in the project fd RequestContext.java # Once located, search for the usage of ACTION_SEARCH_ACROSS_LINEAGE within the RequestContext class ast-grep --lang java --pattern 'class RequestContext { $$$ }' # Search for logging statements within the RequestContext class rg --type java 'log' $(fd RequestContext.java)Length of output: 508
Script:
#!/bin/bash # Search for the toString method within the RequestContext class ast-grep --lang java --pattern 'class RequestContext { $$$ toString() { $$$ } $$$ }' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 182
Script:
#!/bin/bash # Search for the usage of ACTION_SEARCH_ACROSS_LINEAGE within the RequestContext class rg 'ACTION_SEARCH_ACROSS_LINEAGE' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java # Search for other logging mechanisms within the RequestContext class rg 'log' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 415
Script:
#!/bin/bash # Display the contents of the RequestContext class to inspect its methods and parameters cat metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 6178
743-743: Inspectbrowsefor correct RequestContext usage.The
RequestContextsetup forbrowseusesACTION_BROWSE. Confirm that this is used correctly and aligns with the intended logging and security practices.Verification successful
ACTION_BROWSE usage in RequestContext is correct.
The
ACTION_BROWSEconstant is used appropriately within theRequestContext.builder().buildRestli()method. It is part of the request identification process and contributes to logging practices. No issues were found regarding its usage.
RequestContext.javaensures thatACTION_BROWSEis incorporated into the request ID and other context fields.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Check the usage of `ACTION_BROWSE` in RequestContext. # Test: Search for `ACTION_BROWSE` in the logging statements within RequestContext initializations. rg --type java 'RequestContext.*ACTION_BROWSE' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 332
Script:
#!/bin/bash # Description: Check the usage of `ACTION_BROWSE` within the RequestContext class. # Test: Search for `ACTION_BROWSE` in the RequestContext class to verify its usage. rg --type java 'ACTION_BROWSE' | rg 'RequestContext'Length of output: 334
Script:
#!/bin/bash # Description: Check the usage of `ACTION_BROWSE` across the entire codebase. # Test: Search for `ACTION_BROWSE` in the entire codebase to verify its usage and implications. rg --type java 'ACTION_BROWSE'Length of output: 622
Script:
#!/bin/bash # Description: Check the implementation of the `buildRestli` method within the `RequestContext` class. # Test: Search for the `buildRestli` method in the `RequestContext` class to understand its implementation. rg --type java 'buildRestli' | rg 'RequestContext'Length of output: 11945
Script:
#!/bin/bash # Description: Check the implementation of the `buildRestli` method in `RequestContext.java`. # Test: Search for the implementation of the `buildRestli` method in `RequestContext.java` to verify its handling of `ACTION_BROWSE`. rg --type java 'buildRestli' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 293
Script:
#!/bin/bash # Description: Retrieve the full implementation of the `buildRestli` method from `RequestContext.java`. # Test: Extract the full method implementation of `buildRestli` in `RequestContext.java` to verify its handling of `ACTION_BROWSE`. rg -A 20 'public RequestContext buildRestli' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 1668
1083-1083: CheckbatchGetTotalEntityCountfor correct RequestContext implementation.The
RequestContextis built withbatchGetTotalEntityCount. Verify that this action is correctly logged and the parameters are handled securely.Verification successful
Verify
batchGetTotalEntityCountinRequestContextImplementationThe
RequestContextbuilder methodbuildRestlicorrectly handles parameters securely, including logging theRequestContextobject uniformly across APIs. However, there are no specific logging statements forbatchGetTotalEntityCount.
RequestContextclass:metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaScripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the logging for `batchGetTotalEntityCount` in RequestContext. # Test: Search for logging statements related to `batchGetTotalEntityCount` in RequestContext initializations. rg --type java 'RequestContext.*batchGetTotalEntityCount' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 350
Script:
#!/bin/bash # Description: Verify logging and parameter handling for `batchGetTotalEntityCount` in RequestContext. # Search for logging statements related to `batchGetTotalEntityCount`. rg --type java 'log.*batchGetTotalEntityCount' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/ # Inspect the handling of parameters in RequestContext. rg --type java 'RequestContext' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/Length of output: 10406
Script:
#!/bin/bash # Description: Verify logging and parameter handling for `batchGetTotalEntityCount` in RequestContext. # Search for logging statements related to `batchGetTotalEntityCount` across the entire codebase. rg --type java 'log.*batchGetTotalEntityCount' # Locate the RequestContext class or builder methods. rg --files-with-matches 'class RequestContext' | xargs -I {} rg 'buildRestli'Length of output: 12204
Script:
#!/bin/bash # Description: Inspect the buildRestli method in the RequestContext class to verify parameter handling. # Extract the buildRestli method from the RequestContext class. ast-grep --lang java --pattern 'public RequestContext buildRestli($_, $_, $_, $_) { $$$ }' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 668
Script:
#!/bin/bash # Description: Locate the RequestContext class and extract the buildRestli method to verify parameter handling. # Locate the RequestContext class definition. rg --files-with-matches 'class RequestContext' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/ # Extract the buildRestli method from the RequestContext class. ast-grep --lang java --pattern 'public RequestContext buildRestli($_, $_, $_, $_) { $$$ }' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java || ast-grep --lang java --pattern 'RequestContext buildRestli($_, $_, $_, $_) { $$$ }' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 1545
Script:
#!/bin/bash # Description: Print the contents of the RequestContext class to manually review the buildRestli method. # Print the contents of the RequestContext class. cat metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 6178
481-481: InspectscrollAcrossEntitiesfor correct RequestContext implementation.Verify that the
ACTION_SCROLL_ACROSS_ENTITIESinRequestContextis implemented correctly, ensuring it meets the logging and security requirements outlined in the PR.
397-397: Assess thesearchoperation's RequestContext setup.The
RequestContextfor thesearchoperation usesACTION_SEARCH. This should be scrutinized to ensure it aligns with the security and logging requirements.Verification successful
Verification of
ACTION_SEARCHinRequestContextsetupThe
RequestContextsetup for thesearchoperation withACTION_SEARCHaligns with the security and logging requirements. Security checks are handled by theauthorizerandauthcomponents, and logging is implemented throughout the codebase, including within theEntityResourceclass.
EntityResource.java:
- Security: Utilizes
authorizerandauthcomponents.- Logging: Multiple logging statements present.
Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the correct usage of `ACTION_SEARCH` in RequestContext. # Test: Search for `ACTION_SEARCH` in the RequestContext initializations. rg --type java 'RequestContext.*ACTION_SEARCH' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 675
Script:
#!/bin/bash # Description: Verify the security and logging configurations for ACTION_SEARCH # Test: Search for all instances of ACTION_SEARCH in the codebase to identify related security and logging configurations or checks. rg --type java 'ACTION_SEARCH'Length of output: 1890
Script:
#!/bin/bash # Description: Search for the definition and methods of the RequestContext class to identify security and logging configurations. # Test: Locate the RequestContext class definition. rg --type java 'class RequestContext' # Test: Search for methods within the RequestContext class. rg --type java --pcre2 '(public|private|protected) .*?RequestContext'Length of output: 2664
Script:
#!/bin/bash # Description: Inspect the buildRestli method within the RequestContext class for security and logging configurations. # Test: Search for the buildRestli method within the RequestContext class. rg --type java 'RequestContext buildRestli' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 258
Script:
#!/bin/bash # Description: Retrieve the implementation details of the buildRestli method within the RequestContext class. # Test: Extract the implementation of the buildRestli method from the RequestContext class. rg --type java --context 20 'public RequestContext buildRestli' metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javaLength of output: 2329
Script:
#!/bin/bash # Description: Review usages of RequestContext within the EntityResource class for security and logging. # Test: Search for usages of RequestContext within the EntityResource class. rg --type java 'RequestContext' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 4245
Script:
#!/bin/bash # Description: Verify how `authorizer` and `auth` are utilized in conjunction with `RequestContext` in `EntityResource`. # Test: Search for usages of `authorizer` and `auth` within the `EntityResource` class. rg --type java 'authorizer|auth' metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.javaLength of output: 11247
Script:
#!/bin/bash # Description: Search for logging configurations or utilities used within the project. # Test: Search for logging-related configurations or utilities in the codebase. rg --type java 'Logger|log|LogUtil'Length of output: 287596
292-292: Checkingestmethod for correct RequestContext handling.The
RequestContextis built withACTION_INGEST. It's crucial to ensure that this action is correctly logged and the parameters are handled securely.
964-964: CheckdeleteTimeseriesAspectsfor appropriate RequestContext setup.Ensure that the
deleteTimeseriesAspectsaction inRequestContextis appropriately implemented, with correct logging and parameter handling.
...ervlet/src/main/java/io/datahubproject/openapi/v2/controller/PlatformEntitiesController.java
Show resolved
Hide resolved
...restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.java
Outdated
Show resolved
Hide resolved
david-leifker
force-pushed
the
add-source-logging
branch
from
4929089 to
72d79ce
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
Outside diff range and nitpick comments (1)
metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java (1)
Line range hint
17-182: Comprehensive review of RequestContext enhancements.The modifications in
RequestContextare extensive but necessary for the enhanced logging capabilities. The use of@Nonnullannotations helps ensure thatnullvalues are handled properly. The logging at the constructor level is a good practice for debugging and monitoring purposes.However, ensure that the logging does not inadvertently expose sensitive information such as IP addresses or user agents in a production environment.
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (27)
- metadata-operation-context/build.gradle (1 hunks)
- metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java (4 hunks)
- metadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/GraphQLController.java (2 hunks)
- metadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/SpringQueryContext.java (2 hunks)
- metadata-service/openapi-analytics-servlet/build.gradle (1 hunks)
- metadata-service/openapi-analytics-servlet/src/main/java/io/datahubproject/openapi/delegates/DatahubUsageEventsImpl.java (3 hunks)
- metadata-service/openapi-entity-servlet/src/main/java/io/datahubproject/openapi/v2/delegates/EntityApiDelegateImpl.java (13 hunks)
- metadata-service/openapi-entity-servlet/src/main/resources/JavaSpring/apiController.mustache (1 hunks)
- metadata-service/openapi-entity-servlet/src/test/java/io/datahubproject/openapi/config/OpenAPIEntityTestConfiguration.java (3 hunks)
- metadata-service/openapi-servlet/build.gradle (1 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/controller/GenericEntitiesController.java (21 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/openlineage/controller/LineageApiImpl.java (3 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/operations/elastic/OperationsController.java (11 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v1/entities/EntitiesController.java (7 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/EntityController.java (3 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/PlatformEntitiesController.java (3 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/TimeseriesController.java (3 hunks)
- metadata-service/openapi-servlet/src/test/java/entities/EntitiesControllerTest.java (1 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/analytics/Analytics.java (3 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/AspectResource.java (5 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/BatchIngestionRunResource.java (2 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.java (23 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityV2Resource.java (2 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityVersionedV2Resource.java (1 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/operations/OperationsResource.java (3 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/operations/Utils.java (3 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/usage/UsageStats.java (3 hunks)
Files skipped from review as they are similar to previous changes (25)
- metadata-operation-context/build.gradle
- metadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/GraphQLController.java
- metadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/SpringQueryContext.java
- metadata-service/openapi-analytics-servlet/build.gradle
- metadata-service/openapi-analytics-servlet/src/main/java/io/datahubproject/openapi/delegates/DatahubUsageEventsImpl.java
- metadata-service/openapi-entity-servlet/src/main/java/io/datahubproject/openapi/v2/delegates/EntityApiDelegateImpl.java
- metadata-service/openapi-entity-servlet/src/main/resources/JavaSpring/apiController.mustache
- metadata-service/openapi-servlet/build.gradle
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/controller/GenericEntitiesController.java
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/openlineage/controller/LineageApiImpl.java
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/operations/elastic/OperationsController.java
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v1/entities/EntitiesController.java
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/EntityController.java
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/PlatformEntitiesController.java
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/TimeseriesController.java
- metadata-service/openapi-servlet/src/test/java/entities/EntitiesControllerTest.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/analytics/Analytics.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/AspectResource.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/BatchIngestionRunResource.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityV2Resource.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityVersionedV2Resource.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/operations/OperationsResource.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/operations/Utils.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/usage/UsageStats.java
Additional comments not posted (1)
metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java (1)
3-5: Import statements reviewed and approved.
These imports are necessary for the new functionalities introduced in theRequestContext.
| @@ -109,7 +111,7 @@ public EntityRegistry entityRegistry() throws EntityRegistryException, Interrupt | |||
| @Primary | |||
| public EntitiesController entitiesController() { | |||
| EntitiesController entitiesController = mock(EntitiesController.class); | |||
| when(entitiesController.getEntities(any(), any())) | |||
| when(entitiesController.getEntities(nullable(HttpServletRequest.class), any(), any())) | |||
There was a problem hiding this comment.
Tip
Codebase Verification
Ensure proper handling of null HttpServletRequests in production code.
The following files are missing null checks for HttpServletRequest instances. Please review and update these files to handle potential null values to prevent NullPointerExceptions:
metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.javametadata-service/auth-filter/src/main/java/com/datahub/auth/authentication/filter/AuthenticationFilter.javametadata-service/auth-filter/src/test/java/com/datahub/auth/authentication/AuthenticationFilterTest.javametadata-service/factories/src/main/java/com/linkedin/r2/transport/http/server/AbstractJakartaR2Servlet.javametadata-service/factories/src/main/java/com/linkedin/r2/transport/http/server/JakartaServletHelper.javametadata-service/factories/src/main/java/com/linkedin/restli/server/RestliHandlerServlet.javametadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/GraphQLController.javametadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/SpringQueryContext.javametadata-service/openapi-analytics-servlet/src/main/java/io/datahubproject/openapi/delegates/DatahubUsageEventsImpl.javametadata-service/openapi-entity-servlet/src/main/java/io/datahubproject/openapi/v2/delegates/EntityApiDelegateImpl.javametadata-service/openapi-entity-servlet/src/test/java/io/datahubproject/openapi/config/OpenAPIEntityTestConfiguration.javametadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/controller/GenericEntitiesController.javametadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/openlineage/controller/LineageApiImpl.javametadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/operations/elastic/OperationsController.javametadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v1/entities/EntitiesController.javametadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/EntityController.javametadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/PlatformEntitiesController.javametadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/TimeseriesController.javametadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/analytics/Analytics.javametadata-service/schema-registry-api/generated/src/main/java/io/swagger/api/CompatibilityApi.javametadata-service/schema-registry-api/generated/src/main/java/io/swagger/api/CompatibilityApiController.javametadata-service/schema-registry-api/generated/src/main/java/io/swagger/api/ConfigApi.javametadata-service/schema-registry-api/generated/src/main/java/io/swagger/api/ConfigApiController.javametadata-service/schema-registry-api/generated/src/main/java/io/swagger/api/ContextsApi.javametadata-service/schema-registry-api/generated/src/main/java/io/swagger/api/ContextsApiController.javametadata-service/schema-registry-api/generated/src/main/java/io/swagger/api/DefaultApi.javametadata-service/schema-registry-api/generated/src/main/java/io/swagger/api/DefaultApiController.javametadata-service/schema-registry-api/generated/src/main/java/io/swagger/api/ModeApi.javametadata-service/schema-registry-api/generated/src/main/java/io/swagger/api/ModeApiController.javametadata-service/schema-registry-api/generated/src/main/java/io/swagger/api/SchemasApi.javametadata-service/schema-registry-api/generated/src/main/java/io/swagger/api/SchemasApiController.javametadata-service/schema-registry-api/generated/src/main/java/io/swagger/api/SubjectsApi.javametadata-service/schema-registry-api/generated/src/main/java/io/swagger/api/SubjectsApiController.javametadata-service/schema-registry-api/generated/src/main/java/io/swagger/api/V1Api.javametadata-service/schema-registry-api/generated/src/main/java/io/swagger/api/V1ApiController.javametadata-service/schema-registry-servlet/src/main/java/io/datahubproject/openapi/schema/registry/SchemaRegistryController.javametadata-service/servlet/src/main/java/com/datahub/gms/servlet/Config.javametadata-service/servlet/src/main/java/com/datahub/gms/servlet/ConfigSearchExport.javametadata-service/servlet/src/main/java/com/datahub/gms/servlet/HealthCheck.java
Analysis chain
Ensure proper handling of null HttpServletRequests in production code.
The test configuration now allows for null HttpServletRequests. Verify that the production code gracefully handles these cases to prevent potential NullPointerExceptions.
Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Verify that all usages of HttpServletRequest in production code check for null values.
# Test: Search for HttpServletRequest usages and ensure they are checked for null.
rg --type java 'HttpServletRequest' | xargs -I {} sh -c "grep -q 'if (.* != null)' {} || echo 'Null check missing in {}'"
Length of output: 15333
Script:
#!/bin/bash
# Description: Verify that all usages of HttpServletRequest in production code check for null values.
# Search for all usages of HttpServletRequest and check for null checks
rg --type java 'HttpServletRequest' | awk -F: '{print $1}' | sort -u | xargs -I {} sh -c 'grep -E "HttpServletRequest.*=.*null" {} || echo "Null check missing in {}"'
Length of output: 5024
* actor * ip address * api type * api request info * user agent
david-leifker
force-pushed
the
add-source-logging
branch
from
72d79ce to
2d95f53
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (27)
- metadata-operation-context/build.gradle (1 hunks)
- metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java (4 hunks)
- metadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/GraphQLController.java (2 hunks)
- metadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/SpringQueryContext.java (2 hunks)
- metadata-service/openapi-analytics-servlet/build.gradle (1 hunks)
- metadata-service/openapi-analytics-servlet/src/main/java/io/datahubproject/openapi/delegates/DatahubUsageEventsImpl.java (3 hunks)
- metadata-service/openapi-entity-servlet/src/main/java/io/datahubproject/openapi/v2/delegates/EntityApiDelegateImpl.java (13 hunks)
- metadata-service/openapi-entity-servlet/src/main/resources/JavaSpring/apiController.mustache (1 hunks)
- metadata-service/openapi-entity-servlet/src/test/java/io/datahubproject/openapi/config/OpenAPIEntityTestConfiguration.java (3 hunks)
- metadata-service/openapi-servlet/build.gradle (1 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/controller/GenericEntitiesController.java (21 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/openlineage/controller/LineageApiImpl.java (3 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/operations/elastic/OperationsController.java (11 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v1/entities/EntitiesController.java (7 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/EntityController.java (3 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/PlatformEntitiesController.java (3 hunks)
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/TimeseriesController.java (3 hunks)
- metadata-service/openapi-servlet/src/test/java/entities/EntitiesControllerTest.java (1 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/analytics/Analytics.java (3 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/AspectResource.java (5 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/BatchIngestionRunResource.java (2 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.java (23 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityV2Resource.java (2 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityVersionedV2Resource.java (1 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/operations/OperationsResource.java (3 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/operations/Utils.java (3 hunks)
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/usage/UsageStats.java (3 hunks)
Files not reviewed due to errors (1)
- metadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/GraphQLController.java (no review received)
Files skipped from review as they are similar to previous changes (26)
- metadata-operation-context/build.gradle
- metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java
- metadata-service/graphql-servlet-impl/src/main/java/com/datahub/graphql/SpringQueryContext.java
- metadata-service/openapi-analytics-servlet/build.gradle
- metadata-service/openapi-analytics-servlet/src/main/java/io/datahubproject/openapi/delegates/DatahubUsageEventsImpl.java
- metadata-service/openapi-entity-servlet/src/main/java/io/datahubproject/openapi/v2/delegates/EntityApiDelegateImpl.java
- metadata-service/openapi-entity-servlet/src/main/resources/JavaSpring/apiController.mustache
- metadata-service/openapi-entity-servlet/src/test/java/io/datahubproject/openapi/config/OpenAPIEntityTestConfiguration.java
- metadata-service/openapi-servlet/build.gradle
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/controller/GenericEntitiesController.java
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/openlineage/controller/LineageApiImpl.java
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/operations/elastic/OperationsController.java
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v1/entities/EntitiesController.java
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/EntityController.java
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/PlatformEntitiesController.java
- metadata-service/openapi-servlet/src/main/java/io/datahubproject/openapi/v2/controller/TimeseriesController.java
- metadata-service/openapi-servlet/src/test/java/entities/EntitiesControllerTest.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/analytics/Analytics.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/AspectResource.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/BatchIngestionRunResource.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityV2Resource.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityVersionedV2Resource.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/operations/OperationsResource.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/operations/Utils.java
- metadata-service/restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/usage/UsageStats.java
...restli-servlet-impl/src/main/java/com/linkedin/metadata/resources/entity/EntityResource.java
Outdated
Show resolved
Hide resolved
metadata-operation-context/src/main/java/io/datahubproject/metadata/context/RequestContext.java
Outdated
Show resolved
Hide resolved
Logs additional request information:
GraphQL
Restli
OpenAPI
Checklist
Summary by CodeRabbit
New Features
Enhancements
actorUrn,sourceIP, anduserAgentin request handlers.buildGraphql,buildRestli, andbuildOpenapimethods to include additional parameters for better request context processing.Refactor
HttpServletRequestparameters, enabling enriched request processing and context information handling.Dependency Updates
servletApiandrestliServerdependencies to support new features and improvements.