This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 38ff66d5252d CAMEL-24210: redact api-key and Authorization from
sanitized URIs
38ff66d5252d is described below
commit 38ff66d5252d698f0d37ebe41f56609ffb6b5e62
Author: Andrea Cosentino <[email protected]>
AuthorDate: Wed Jul 22 09:08:47 2026 +0200
CAMEL-24210: redact api-key and Authorization from sanitized URIs
URI sanitization (logs, JMX, exceptions, dev console) now also masks
endpoint
parameters containing 'api-key' (hyphenated) or 'authorization'. Previously
credentials supplied via hyphenated parameter names like
additionalHeader.api-key (Azure OpenAI auth header) were written in clear
text
even though the camelCase apiKey was already redacted. Adds api-key and
authorization to the sensitive-keyword generator's EXTRA_KEYS, regenerates
SensitiveUtils and sensitive-keys.json, and includes unit tests for both
forms.
Closes #24984
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---
.../org/apache/camel/catalog/main/sensitive-keys.json | 2 ++
.../main/java/org/apache/camel/util/SensitiveUtils.java | 4 ++++
.../test/java/org/apache/camel/util/URISupportTest.java | 15 +++++++++++++++
.../modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc | 14 ++++++++++++++
.../camel/maven/packaging/UpdateSensitizeHelper.java | 11 ++++++++---
5 files changed, 43 insertions(+), 3 deletions(-)
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/main/sensitive-keys.json
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/main/sensitive-keys.json
index 533bf197224c..376fbe12a04b 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/main/sensitive-keys.json
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/main/sensitive-keys.json
@@ -5,6 +5,7 @@
"accountkey",
"accountsid",
"acltoken",
+ "api-key",
"api_key",
"api_secret",
"apikey",
@@ -13,6 +14,7 @@
"apiusername",
"authenticationtoken",
"authkey",
+ "authorization",
"authorizationtoken",
"authtoken",
"azureclientid",
diff --git
a/core/camel-util/src/main/java/org/apache/camel/util/SensitiveUtils.java
b/core/camel-util/src/main/java/org/apache/camel/util/SensitiveUtils.java
index bae454ede5b7..18c0bf4b8435 100644
--- a/core/camel-util/src/main/java/org/apache/camel/util/SensitiveUtils.java
+++ b/core/camel-util/src/main/java/org/apache/camel/util/SensitiveUtils.java
@@ -34,6 +34,7 @@ public final class SensitiveUtils {
"accountkey",
"accountsid",
"acltoken",
+ "api-key",
"api_key",
"api_secret",
"apikey",
@@ -42,6 +43,7 @@ public final class SensitiveUtils {
"apiusername",
"authenticationtoken",
"authkey",
+ "authorization",
"authorizationtoken",
"authtoken",
"azureclientid",
@@ -131,6 +133,7 @@ public final class SensitiveUtils {
+ "|\\Qaccountkey\\E"
+ "|\\Qaccountsid\\E"
+ "|\\Qacltoken\\E"
+ + "|\\Qapi-key\\E"
+ "|\\Qapi_key\\E"
+ "|\\Qapi_secret\\E"
+ "|\\Qapikey\\E"
@@ -139,6 +142,7 @@ public final class SensitiveUtils {
+ "|\\Qapiusername\\E"
+
"|\\Qauthenticationtoken\\E"
+ "|\\Qauthkey\\E"
+ + "|\\Qauthorization\\E"
+
"|\\Qauthorizationtoken\\E"
+ "|\\Qauthtoken\\E"
+ "|\\Qazureclientid\\E"
diff --git
a/core/camel-util/src/test/java/org/apache/camel/util/URISupportTest.java
b/core/camel-util/src/test/java/org/apache/camel/util/URISupportTest.java
index 48f908ba55d8..ac01d6891a94 100644
--- a/core/camel-util/src/test/java/org/apache/camel/util/URISupportTest.java
+++ b/core/camel-util/src/test/java/org/apache/camel/util/URISupportTest.java
@@ -274,6 +274,21 @@ public class URISupportTest {
assertEquals("telegram:bots?authorizationToken=xxxxxx", out1);
}
+ @Test
+ void testSanitizeApiKeyHeader() {
+ // a hyphenated api-key header name (e.g. the Azure OpenAI auth header
supplied via additionalHeader.*)
+ // must be redacted from a sanitized URI, just like the camelCase
apiKey option
+ String out =
URISupport.sanitizeUri("openai:CHAT?baseUrl=https://host&additionalHeader.api-key=MY_SECRET";);
+
assertThat(out).isEqualTo("openai:CHAT?baseUrl=https://host&additionalHeader.api-key=xxxxxx";);
+ }
+
+ @Test
+ void testSanitizeAuthorizationHeader() {
+ // a bare Authorization header (e.g. supplied via additionalHeader.*)
must be redacted
+ String out =
URISupport.sanitizeUri("openai:CHAT?additionalHeader.Authorization=Bearer%20MY_SECRET");
+
assertThat(out).isEqualTo("openai:CHAT?additionalHeader.Authorization=xxxxxx");
+ }
+
@Test
public void testSanitizeUriWithUserInfo() {
String uri =
"jt400://GEORGE:HARRISON@LIVERPOOL/QSYS.LIB/BEATLES.LIB/PENNYLANE.DTAQ";
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
index 31c783f35cfb..c6df7afb419d 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
@@ -671,6 +671,20 @@ If you were relying on non-durable queues, you can restore
the previous behavior
setting `arg.queue.durable=false&arg.queue.exclusive=true` on the endpoint
URI. Note that
RabbitMQ 4.3+ requires non-durable queues to also be exclusive.
+=== camel-core - additional sensitive keywords redacted from sanitized URIs
+
+The URI sanitization used for logs, JMX attributes, exception messages and the
developer console
+(`URISupport.sanitizeUri`) now also redacts endpoint parameters whose name
contains `api-key` (hyphenated)
+or `authorization`. Previously a credential supplied through a hyphenated or
`Authorization`-style
+parameter/header name — for example `additionalHeader.api-key=...` (the Azure
OpenAI auth header) or
+`additionalHeader.Authorization=...` in `camel-openai` — was written in clear
text in sanitized URIs, even
+though the camelCase `apiKey` option was already redacted.
+
+Because matching is a case-insensitive substring match, parameter names that
merely contain `authorization`
+without being secrets — `adjustAuthorization`, `jwtAuthorizationType`,
`proxyAuthorizationPolicy` — now also
+have their values shown as `xxxxxx` in sanitized URIs. This is a cosmetic
change to sanitized output only and
+does not affect the actual endpoint configuration.
+
=== camel-core - Multicast UseOriginalAggregationStrategy fix
The Multicast EIP now correctly honors `UseOriginalAggregationStrategy`,
consistent with the Splitter
diff --git
a/tooling/maven/camel-package-maven-plugin/src/main/java/org/apache/camel/maven/packaging/UpdateSensitizeHelper.java
b/tooling/maven/camel-package-maven-plugin/src/main/java/org/apache/camel/maven/packaging/UpdateSensitizeHelper.java
index 8d8503791c3b..20be84f0518f 100644
---
a/tooling/maven/camel-package-maven-plugin/src/main/java/org/apache/camel/maven/packaging/UpdateSensitizeHelper.java
+++
b/tooling/maven/camel-package-maven-plugin/src/main/java/org/apache/camel/maven/packaging/UpdateSensitizeHelper.java
@@ -76,10 +76,15 @@ public class UpdateSensitizeHelper extends
AbstractGeneratorMojo {
private static final Map<String, String> VALUE_CONSTANTS = Map.of(
"false", "VALUE_FALSE");
- // extra keys that are regarded as secret which may not yet been in any
component
- // they MUST be in lowercase and without a dash
+ // extra keys that are regarded as secret which may not yet been in any
component.
+ // they MUST be in lowercase; keep them without a dash unless a dashed
variant is required to cover a
+ // hyphenated parameter/header name in the URISupport.sanitizeUri regex
path (which, unlike
+ // SensitiveUtils.containsSensitive, does not strip dashes before
matching): "api-key" covers the Azure
+ // OpenAI api-key header, and "authorization" covers the standard
Authorization header.
private static final String[] EXTRA_KEYS
- = new String[] { "apipassword", "apiuser", "apiusername",
"api_key", "api_secret", SECRET, "keystorePassword" };
+ = new String[] {
+ "apipassword", "apiuser", "apiusername", "api_key",
"api-key", "api_secret", "authorization",
+ SECRET, "keystorePassword" };
// extra security options from camel-main properties that are not in
component JSON files
// each entry: option name (lowercase, no dashes), security category,
insecure value
