DaanHoogland commented on code in PR #13677:
URL: https://github.com/apache/cloudstack/pull/13677#discussion_r3644759501
##########
server/src/main/java/com/cloud/api/ApiServlet.java:
##########
@@ -78,7 +79,19 @@ public class ApiServlet extends HttpServlet {
protected static Logger LOGGER = LogManager.getLogger(ApiServlet.class);
private static final Logger ACCESSLOGGER =
LogManager.getLogger("apiserver." + ApiServlet.class.getName());
private static final String REPLACEMENT = "_";
- private static final String LOGGER_REPLACEMENTS = "[\n\r\t]";
+private static final String REDACTED = "REDACTED";
+private static final String LOGGER_REPLACEMENTS = "[\n\r\t]";
+
+private static final Set<String> SENSITIVE_PARAMETER_KEYWORDS = Set.of(
+ "password",
+ "privatekey",
+ "accesskey",
+ "secretkey",
+ "apikey",
+ "signature",
+ "sessionkey",
+ "token"
+);
Review Comment:
indent seems off
##########
server/src/main/java/com/cloud/api/ApiServlet.java:
##########
@@ -161,12 +174,32 @@ private void checkSingleQueryParameterValue(Map<String,
String[]> params) {
params.forEach((k, v) -> {
if (v.length > 1) {
String message = String.format("Query parameter '%s' has
multiple values %s. Only the last value will be respected." +
- "It is advised to pass only a single parameter", k,
Arrays.toString(v));
+ "It is advised to pass only a single parameter", k,
formatValuesForLog(k, v));
LOGGER.warn(message);
}
});
}
+ static boolean isSensitiveParameter(String parameterName) {
+ if (parameterName == null) {
+ return false;
+ }
+
+ String lowerCaseParameter = parameterName.toLowerCase();
+ return SENSITIVE_PARAMETER_KEYWORDS.stream()
+ .anyMatch(lowerCaseParameter::contains);
+}
+
+static String formatValuesForLog(String parameterName, String[] values) {
+ if (!isSensitiveParameter(parameterName)) {
+ return Arrays.toString(values);
+ }
+
+ String[] masked = new String[values.length];
+ Arrays.fill(masked, REDACTED);
+ return Arrays.toString(masked);
+}
Review Comment:
indent is off for this bit as well
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
