lukaszlenart commented on code in PR #1738:
URL: https://github.com/apache/struts/pull/1738#discussion_r3409199835
##########
core/src/main/java/org/apache/struts2/util/TokenHelper.java:
##########
@@ -186,10 +187,10 @@ public static boolean validToken() {
if (!token.equals(sessionToken)) {
if (LOG.isWarnEnabled()) {
LocalizedTextProvider localizedTextProvider =
ActionContext.getContext().getContainer().getInstance(LocalizedTextProvider.class);
- LOG.warn(localizedTextProvider.findText(TokenHelper.class,
"struts.internal.invalid.token", ActionContext.getContext().getLocale(), "Form
token {0} does not match the session token {1}.", new Object[]{
- token, sessionToken
- }));
- }
+ LOG.warn(localizedTextProvider.findText(TokenHelper.class,
"struts.internal.invalid.token", ActionContext.getContext().getLocale(), "The
provided form token does not match the expected session token.", new
Object[0]));
Review Comment:
Personally I would leave the incoming token in the log message, this isn't a
sensitive information
##########
core/src/main/java/org/apache/struts2/util/TokenHelper.java:
##########
@@ -186,10 +187,10 @@ public static boolean validToken() {
if (!token.equals(sessionToken)) {
if (LOG.isWarnEnabled()) {
LocalizedTextProvider localizedTextProvider =
ActionContext.getContext().getContainer().getInstance(LocalizedTextProvider.class);
- LOG.warn(localizedTextProvider.findText(TokenHelper.class,
"struts.internal.invalid.token", ActionContext.getContext().getLocale(), "Form
token {0} does not match the session token {1}.", new Object[]{
- token, sessionToken
- }));
- }
+ LOG.warn(localizedTextProvider.findText(TokenHelper.class,
"struts.internal.invalid.token", ActionContext.getContext().getLocale(), "The
provided form token does not match the expected session token.", new
Object[0]));
+ }
+ LOG.debug("Token mismatch for token name [{}]: form token present
[{}], session token present [{}]",
+ normalizeSpace(tokenName), token != null, sessionToken !=
null);
Review Comment:
Wouldn't be better to use `devMode` and log the full tokens then?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
