From ebd1c4e938afbf23abf6029b5b21c9945806fc11 Mon Sep 17 00:00:00 2001
From: jamesread <contact@jread.com>
Date: Tue, 5 Apr 2022 12:19:24 +0100
Subject: [PATCH] security: Use quoted values for origin, URL, and force
 quoting.

---
 cmd/OliveTin/main.go                   | 5 +++++
 internal/cors/cors.go                  | 2 +-
 internal/httpservers/singleFrontend.go | 4 ++--
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/cmd/OliveTin/main.go b/cmd/OliveTin/main.go
index 01f4638f..a8520bce 100644
--- a/cmd/OliveTin/main.go
+++ b/cmd/OliveTin/main.go
@@ -22,6 +22,11 @@ var (
 )
 
 func init() {
+	log.SetFormatter(&log.TextFormatter{
+		ForceQuote: true,
+		DisableTimestamp: true,
+	})
+
 	log.WithFields(log.Fields{
 		"version": version,
 		"commit":  commit,
diff --git a/internal/cors/cors.go b/internal/cors/cors.go
index 9bf6a5f1..905ed462 100644
--- a/internal/cors/cors.go
+++ b/internal/cors/cors.go
@@ -13,7 +13,7 @@ import (
 func AllowCors(h http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if origin := r.Header.Get("Origin"); origin != "" {
-			log.Debugf("Adding CORS header origin: %v", origin)
+			log.Debugf("Adding CORS header origin: %q", origin)
 
 			w.Header().Set("Access-Control-Allow-Origin", origin)
 		}
diff --git a/internal/httpservers/singleFrontend.go b/internal/httpservers/singleFrontend.go
index 35305b51..9207dc05 100644
--- a/internal/httpservers/singleFrontend.go
+++ b/internal/httpservers/singleFrontend.go
@@ -32,12 +32,12 @@ func StartSingleHTTPFrontend(cfg *config.Config) {
 	mux := http.NewServeMux()
 
 	mux.HandleFunc("/api/", func(w http.ResponseWriter, r *http.Request) {
-		log.Debugf("api req: %v", r.URL)
+		log.Debugf("api req: %q", r.URL)
 		apiProxy.ServeHTTP(w, r)
 	})
 
 	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
-		log.Debugf("ui req: %v", r.URL)
+		log.Debugf("ui req: %q", r.URL)
 		webuiProxy.ServeHTTP(w, r)
 	})