CVE-2024-35371

@@ -75,6 +75,8 @@
 
 public abstract class RestServiceBase {
 
+	private static final String REPLACE_CHARS_FOR_SECURITY = "[\n\r]";
+
 	public class BroadcastStatistics {
 
 	    @Schema(description = "The total RTMP viewers of the stream")
@@ -365,6 +367,7 @@ protected Result deleteBroadcasts(String[] streamIds) {
 				result = deleteBroadcast(id);
 				if (!result.isSuccess())
 				{
+					id =  id.replaceAll(REPLACE_CHARS_FOR_SECURITY, "_" );
 					logger.warn("It cannot delete {} and breaking the loop", id);
 					break;
 				}
@@ -1168,6 +1171,7 @@ protected Result deleteVoDs(String[] vodIds)
 
 				if (!result.isSuccess())
 				{
+					id =  id.replaceAll(REPLACE_CHARS_FOR_SECURITY, "_" );
 					logger.warn("VoD:{} cannot be deleted and breaking the loop", id);
 					break;
 				}
@@ -1311,7 +1315,7 @@ protected RecordMuxer startRecord(String streamId, RecordType recordType, int re
 		}
 		else {
 			logger.info("No mux adaptor found for {} recordType:{} resolutionHeight:{}", streamId != null  ?
-					streamId.replaceAll("[\n\r]", "_") : "null ",
+					streamId.replaceAll(REPLACE_CHARS_FOR_SECURITY, "_") : "null ",
 					recordType, resolutionHeight);
 		}
 
@@ -1478,7 +1482,7 @@ else if (!AntMediaApplicationAdapter.PLAY_LIST.equals(broadcast.getType())) {
 				streamFetcher.setStreamFetcherListener(null);
 
 				if (logger.isInfoEnabled()) {
-					logger.info("Switching to next item by REST method for playlist:{} and forwarding stream fetcher listener:{}", id.replaceAll("[\n\r]", "_"), streamFetcherListener.hashCode());
+					logger.info("Switching to next item by REST method for playlist:{} and forwarding stream fetcher listener:{}", id.replaceAll(REPLACE_CHARS_FOR_SECURITY, "_"), streamFetcherListener.hashCode());
 				}
 
 				result = getApplication().getStreamFetcherManager().playItemInList(broadcast, streamFetcherListener, index);