Copilot commented on code in PR #13668:
URL: https://github.com/apache/cloudstack/pull/13668#discussion_r3644592395
##########
utils/src/main/java/com/cloud/utils/ssh/SSHCmdHelper.java:
##########
@@ -248,4 +276,18 @@ public static SSHCmdResult
sshExecuteCmdOneShot(com.trilead.ssh2.Connection sshC
sshSession.close();
}
}
+
+ /**
+ * Returns the version of {@code cmd} that should be logged. When the
caller provides an
+ * already-redacted {@code maskedCmd}, that is used as-is. Otherwise,
falls back to the
+ * legacy heuristic of stripping everything from the first occurrence of
the keystore
+ * filename onwards, which only hides secrets that happen to follow it
(e.g. keystore
+ * setup commands built by {@code LibvirtServerDiscoverer}).
+ */
+ protected static String getCmdForLogging(String cmd, String maskedCmd) {
+ if (maskedCmd != null) {
+ return maskedCmd;
+ }
+ return cmd.split(KeyStoreUtils.KS_FILENAME)[0];
Review Comment:
KeyStoreUtils.KS_FILENAME ("cloud.jks") contains '.', and String.split(...)
treats its argument as a regex. That means the fallback redaction can match
unintended strings (e.g. "cloudXjks"), which contradicts the method’s comment
about matching the keystore filename literally. Use Pattern.quote(...) so the
split is literal and future-proof if the filename contains other regex
metacharacters.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
