This is an automated email from the ASF dual-hosted git repository. reta pushed a commit to branch 3.5.x-fixes in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 8cf3183894c25611b213fffcaa52f98fcb387e45 Author: Andriy Redko <[email protected]> AuthorDate: Sun Nov 24 13:44:51 2024 -0500 CXF-9082: Allow to modify sensitive header list (refactor the methods to accept lists instead of message instance) (cherry picked from commit 8e3365871b4c26a4e31a1977d1cffedcdea743d6) (cherry picked from commit 5caf6cd35dbbb2b28a7dbfa57e074cd96c4239dc) --- .../org/apache/cxf/transport/http/Headers.java | 24 +++++++++++++--------- .../org/apache/cxf/transport/http/HeadersTest.java | 11 ++++++---- 2 files changed, 21 insertions(+), 14 deletions(-) diff --git a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/Headers.java b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/Headers.java index 2beddd28ad..eb598d6f63 100644 --- a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/Headers.java +++ b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/Headers.java @@ -112,11 +112,12 @@ public class Headers { * filtered keys), so it should be used sparingly - i.e. only when debug is * enabled. */ - static String toString(Message message, boolean logSensitiveHeaders) { + static String toString(Map<String, List<Object>> headers, Set<String> sensitiveHeaders, + boolean logSensitiveHeaders) { Map<String, List<Object>> filteredHeaders = new TreeMap<>(String.CASE_INSENSITIVE_ORDER); - filteredHeaders.putAll(CastUtils.cast(getSetProtocolHeaders(message))); + filteredHeaders.putAll(CastUtils.cast(headers)); if (!logSensitiveHeaders) { - for (String filteredKey : getSensitiveHeaders(message)) { + for (String filteredKey : sensitiveHeaders) { filteredHeaders.put(filteredKey, SENSITIVE_HEADER_MARKER); } } @@ -314,13 +315,13 @@ public class Headers { * @param logSensitiveHeaders whether to log sensitive headers */ static void logProtocolHeaders(Logger logger, Level level, - Message message, - boolean logSensitiveHeaders) { + Map<String, List<Object>> headersMap, + Set<String> sensitiveHeaders, + boolean logSensitiveHeaders) { if (logger.isLoggable(level)) { - Map<String, List<Object>> headersMap = CastUtils.cast(getSetProtocolHeaders(message)); for (Map.Entry<String, List<Object>> entry : headersMap.entrySet()) { String key = entry.getKey(); - boolean sensitive = !logSensitiveHeaders && getSensitiveHeaders(message).contains(key); + boolean sensitive = !logSensitiveHeaders && sensitiveHeaders.contains(key); List<Object> headerList = sensitive ? SENSITIVE_HEADER_MARKER : entry.getValue(); for (Object value : headerList) { logger.log(level, key + ": " @@ -371,7 +372,8 @@ public class Headers { transferProtocolHeadersToURLConnection(connection); - logProtocolHeaders(LOG, Level.FINE, message, logSensitiveHeaders()); + Map<String, List<Object>> theHeaders = CastUtils.cast(headers); + logProtocolHeaders(LOG, Level.FINE, theHeaders, getSensitiveHeaders(), logSensitiveHeaders()); } public String determineContentType() { @@ -455,7 +457,9 @@ public class Headers { headers.put(Message.CONTENT_TYPE, Collections.singletonList(req.getContentType())); } if (LOG.isLoggable(Level.FINE)) { - LOG.log(Level.FINE, "Request Headers: " + toString(message, logSensitiveHeaders())); + Map<String, List<Object>> theHeaders = CastUtils.cast(headers); + LOG.log(Level.FINE, "Request Headers: " + toString(theHeaders, getSensitiveHeaders(), + logSensitiveHeaders())); } } @@ -583,7 +587,7 @@ public class Headers { return locale.toString().replace('_', '-'); } - static Set<String> getSensitiveHeaders(Message message) { + private Set<String> getSensitiveHeaders() { return MessageUtils.getContextualStrings(message, SENSITIVE_HEADERS_PROP_NAME, DEFAULT_SENSITIVE_HEADERS); } diff --git a/rt/transports/http/src/test/java/org/apache/cxf/transport/http/HeadersTest.java b/rt/transports/http/src/test/java/org/apache/cxf/transport/http/HeadersTest.java index 642e998fd6..7df2d4400f 100755 --- a/rt/transports/http/src/test/java/org/apache/cxf/transport/http/HeadersTest.java +++ b/rt/transports/http/src/test/java/org/apache/cxf/transport/http/HeadersTest.java @@ -21,6 +21,7 @@ package org.apache.cxf.transport.http; import java.util.Arrays; import java.util.Collections; import java.util.HashMap; +import java.util.HashSet; import java.util.List; import java.util.Locale; import java.util.Map; @@ -108,7 +109,8 @@ public class HeadersTest { headerMap.put("Accept", Arrays.asList("text/plain")); message.put(Message.PROTOCOL_HEADERS, headerMap); - String loggedString = Headers.toString(message, false); + String loggedString = Headers.toString(headerMap, + new HashSet<String>(Arrays.asList("Authorization", "Proxy-Authorization")), false); assertFalse("The value of a sensitive header could be logged: " + loggedString, loggedString.contains("FAIL")); assertTrue("The value of a non-sensitive header would not be logged: " + loggedString, loggedString.contains("application/xml") && loggedString.contains("text/plain")); @@ -125,9 +127,9 @@ public class HeadersTest { headerMap.put("MyCustomHeader", Arrays.asList("Value1")); headerMap.put("NotMyCustomHeader", Arrays.asList("Value2")); message.put(Message.PROTOCOL_HEADERS, headerMap); - message.put("org.apache.http.sensitive.headers", "Authorization,MyCustomHeader"); - String loggedString = Headers.toString(message, false); + String loggedString = Headers.toString(headerMap, + new HashSet<String>(Arrays.asList("Authorization", "MyCustomHeader")), false); assertFalse("The value of a custom sensitive header should not be logged: " + loggedString, loggedString.contains("FAIL")); @@ -189,7 +191,8 @@ public class HeadersTest { // no-op } }); - Headers.logProtocolHeaders(logger, Level.INFO, message, false); + Headers.logProtocolHeaders(logger, Level.INFO, headerMap, + new HashSet<String>(Arrays.asList("Authorization", "Proxy-Authorization")), false); } @Test
