oscerd commented on PR #26803: URL: https://github.com/apache/camel/pull/26803#issuecomment-5809758829
Thanks for the thorough review. The inline comments have their own replies; the points from the review body, addressed in f477989959ba: - **Two userinfo maskers**: there is now one implementation in `SensitiveUtils`, used by `URISupport.sanitizeUri`, `URISupport.sanitizePath` and `SensitiveUtils.maskUserInfoCredentials`. The rule is the one in the reply on `URISupport.java:67`. It revisits the CAMEL-24256 choice of the first `@`: with the first `@`, `ftp://joe:p@ss@host/in` leaves `ss` visible and an `@` in a query (`smtp://host:[email protected]`) is taken for the end of a password. The free-text behaviour from CAMEL-24256 is kept, since in free text a whitespace or a quote still ends a URI. All existing `SensitiveUtilsTest` and `DefaultMaskingFormatterTest` expectations pass unchanged, and the new cases are in `SensitiveUtilsTest#maskUserInfoCredentialsUsesTheSameRuleAsSanitizeUri`. - **`sanitizePath`**: uses the same helper, so `joe:secret@host/[email protected]` becomes `joe:xxxxxx@host/[email protected]`. - **Test global state**: added a package-private `URISupport.resetSanitizeKeywords()`, called from `@AfterEach` in `URISupportTest`. - **Non-sensitive RAW values**: I left this one as is. Skipping those values would stop masking a sensitive parameter written inside one (for example a URL option whose value carries `?token=...`), which `main` masks today, so it would trade a cosmetic issue (the eaten bracket) for masking less. A follow-up could keep searching inside and preserve the bracket, if you think it is worth it. - **PR description**: updated, and it now leads with the fact that on `main` only the last userinfo in a text is masked. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
