prime-reportstream
prime-reportstream copied to clipboard
[H] Add safe type checking when processing inputs
DoD: Sanitize prime-router/src/main/kotlin/transport/EmailTransport.kt input(s) and others impacted by ognl/thymeleaf.
This is especially important when processing HTML text.
https://github.com/CDCgov/prime-reportstream/blob/f56ca7467198df84d225d7e58d00deb3a86097fc/prime-router/src/main/kotlin/transport/EmailTransport.kt#L67-L72
Relates to #18533
Hey team! Please add your planning poker estimate with Zenhub @JFisk42 @wcutshall @cleong14 @jack-h-wang
As stated in #18533 this change is not necessary from a security standpoint as the input for this function is system generated at run time without using external input.