GRIF-683: Fixing invalid ascii characters in LCM bricks parameters

.github/actions/rundeck/action.yaml

@@ -44,6 +44,14 @@ runs:
         echo "${{ steps.cert-from-vault.outputs.ca_chain }}" >> cert.pem
         echo "${{ steps.cert-from-vault.outputs.private_key }}" >> cert.pem
       shell: bash
+    - name: Setup python
+      uses: actions/setup-python@v6
+      with:
+        python-version: "3.12"
+    - name: Install modules
+      shell: bash
+      run: |
+        pip install requests
     - name: Run python script
       id: python
       run: |

VERSION

@@ -1 +1 @@
-3.7.102
+3.7.103

lib/gooddata/helpers/global_helpers_params.rb

@@ -71,15 +71,19 @@ def decode_params(params, options = {})
                              end
 
         reference_values = []
+        sanitize_values = {}
         # Replace reference parameters by the actual values. Use backslash to escape a reference parameter, e.g: \${not_a_param},
         # the ${not_a_param} will not be replaced
         if options[:resolve_reference_params]
-          data_params, reference_values = resolve_reference_params(data_params, params)
+          data_params, reference_values, sanitize_values = resolve_reference_params(data_params, params)
           hidden_data_params, = resolve_reference_params(hidden_data_params, params)
         end
 
         begin
           parsed_data_params = data_params.is_a?(Hash) ? data_params : JSON.parse(data_params)
+          # Invalid ascii characters in data_params make json parse fails. So after escape the invalid ascii
+          # characters to json parse success then We need recover them to origin value
+          recover_sanitize_value(parsed_data_params, sanitize_values) if sanitize_values.any?
         rescue JSON::ParserError => exception
           reason = exception.message
           reference_values.each { |secret_value| reason.gsub!("\"#{secret_value}\"", '"***"') }
@@ -240,8 +244,23 @@ def stringify_values(value)
 
       private
 
+      def invalid_ascii_value(data)
+        data.include?("\n")
+      end
+
+      def recover_sanitize_value(parsed_data_params, sanitize_values)
+        parsed_data_params.map do |k, v|
+          if v.is_a?(Hash)
+            recover_sanitize_value(v, sanitize_values)
+          else
+            parsed_data_params[k] = sanitize_values[v] if sanitize_values.include?(v)
+          end
+        end
+      end
+
       def resolve_reference_params(data_params, params)
         reference_values = []
+        sanitize_values = {}
         regexps = Regexp.union(/\\\\/, /\\\$/, /\$\{([^\n\{\}]+)\}/)
         resolve_reference = lambda do |v|
           if v.is_a? Hash
@@ -266,7 +285,13 @@ def resolve_reference_params(data_params, params)
                 val = params["#{$1}"]
                 if val
                   reference_values << val
-                  val
+                  if invalid_ascii_value(val)
+                    escape_value = val.gsub("\n", "\\n")
+                    sanitize_values[escape_value] = val
+                    escape_value
+                  else
+                    val
+                  end
                 else
                   GoodData.logger.warn "Reference '#{$1}' is not found!"
                   match
@@ -284,7 +309,7 @@ def resolve_reference_params(data_params, params)
                         resolve_reference.call(data_params)
                       end
 
-        [data_params, reference_values]
+        [data_params, reference_values, sanitize_values]
       end
     end
   end

spec/unit/helpers/global_helpers_spec.rb

@@ -162,22 +162,41 @@
           'x' => 'y',
           'ads_password' => 'ads_123',
           'my_password' => 'login_123',
+          'private_key' => '-----TEST-----
+abc
+123
+-----END TEST-----',
           'alias.user' => 'qa+test@gooddata.com',
           'alias.segment' => 'UserTestSegmentK8s',
           'gd_encoded_params' => '{"login_username": "${alias.user}",
                   "login_password": "abc_${my_password}_123" ,
                   "SEGMENTS_FILTER": ["${alias.segment}"],
+                  "connection": {
+                    "username": "${alias.user}",
+                    "db_private_key": "${private_key}"
+                  },
                   "technical_user": ["${alias.user}"]}'
       }
       expected_result = {
           'x' => 'y',
           'ads_password' => 'ads_123',
           'my_password' => 'login_123',
+          'private_key' => '-----TEST-----
+abc
+123
+-----END TEST-----',
           'alias.user' => 'qa+test@gooddata.com',
           'alias.segment' => 'UserTestSegmentK8s',
           'login_username' => 'qa+test@gooddata.com',
           'login_password' => 'abc_login_123_123',
           'SEGMENTS_FILTER' => ["UserTestSegmentK8s"],
+          'connection' => {
+            'username' => 'qa+test@gooddata.com',
+            'db_private_key' => '-----TEST-----
+abc
+123
+-----END TEST-----'
+          },
           'technical_user' => ["qa+test@gooddata.com"]
       }
       result = GoodData::Helpers.decode_params(params, :resolve_reference_params => true)