lsjostro / flumelogger Goto Github PK

It seems that you are using "eval" to parse json here

https://github.com/lsjostro/flumelogger/blob/master/flumelogger/handler.py#L55-L59

This is a security risk, potentially user inputted data can be logged. Its possible that code could be injected here. Also there is no reason not use the json library. I would be happy to create a pull request if anyone wanted.

It's a bad one and I have a fix waiting for it when #16 is merged.

Using version 0.4.1:

Traceback (most recent call last):
3/14/2016 1:44:33 PM  File "/usr/lib/python2.7/site-packages/flumelogger/handler.py", line 102, in emit_one
3/14/2016 1:44:33 PM    self.eventserver.append(tevent, client)
3/14/2016 1:44:33 PM  File "/usr/lib/python2.7/site-packages/flumelogger/eventserver.py", line 170, in append
3/14/2016 1:44:33 PM    raise OperationFailure(e)
3/14/2016 1:44:33 PM  OperationFailure: object of type 'NoneType' has no len()

Maybe this has been addressed since the 0.4.1 release?

I'm looking into it, see if I can spot what it can be...

Hi,

I'm not sure if I've misconfigured something.. but I'm having issues getting my logs through at a comfortable speed.

Looking at the code, I see that each individual log record triggers a new connect/disconnect operation. I would expect performance to improve radically if the log records where to be sent in some sort of batch mode..