(cxf) branch 3.6.x-fixes updated: CXF-9083: Redact form parameter values in conduit debug log (#3594)

[ffang]

This is an automated email from the ASF dual-hosted git repository.

ffang pushed a commit to branch 3.6.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/3.6.x-fixes by this push:
     new dadd1f5d5db CXF-9083: Redact form parameter values in conduit debug 
log (#3594)
dadd1f5d5db is described below

commit dadd1f5d5db0cc58520a79f83530ed55a6252947
Author: Freeman(Yue) Fang <freeman.f...@gmail.com>
AuthorDate: Fri Oct 16 16:17:25 2026 -0400

    CXF-9083: Redact form parameter values in conduit debug log (#3594)
    
    * CXF-9083: Redact form parameter values in conduit debug log
    
    HTTPConduit was logging the full cached request body at FINE level
    during redirect and retransmit handling, exposing sensitive form
    parameters (e.g. client_secret) in debug logs. The standard
    LoggingFeature cannot filter this since it bypasses the interceptor
    chain.
    
    For form-urlencoded content, redact parameter values while preserving
    keys (e.g. "client_secret=***"). For other content types, log only
    the message size.
    
    * CXF-9083: Simplify to log message size only instead of redacting form 
params
    
    Remove FORM_PARAM_VALUE_PATTERN, redactMessageBody method, and associated
    tests. The retransmit/redirect log now shows only the byte count, avoiding
    any risk of leaking sensitive content regardless of content type. Users who
    need body-level logging can use LoggingFeature on the interceptor chain.
    
    (cherry picked from commit 3b8d8d360524d1ca72e2fa4d3ec54cc8de892a9e)
    (cherry picked from commit d11cf4741947138308d3e8a27cd4b0e07c42588f)
---
 .../java/org/apache/cxf/transport/http/HTTPConduit.java  | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git 
a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/HTTPConduit.java
 
b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/HTTPConduit.java
index dcbcc8fbe59..77721d73466 100644
--- 
a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/HTTPConduit.java
+++ 
b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/HTTPConduit.java
@@ -1336,9 +1336,8 @@ public abstract class HTTPConduit
                 LOG.fine("Conduit \""
                          + getConduitName()
                          + "\" Retransmit message to: "
-                         + newURL
-                         + ": "
-                         + new String(cachedStream.getBytes()));
+                         + newURL + ": ("
+                         + cachedStream.size() + " bytes)");
             }
         }
 
@@ -1475,13 +1474,10 @@ public abstract class HTTPConduit
                 || authSupplier != null && 
authSupplier.requiresRequestCaching()) {
 
                 if (LOG.isLoggable(Level.FINE) && cachedStream != null) {
-                    StringBuilder b = new StringBuilder(4096);
-                    b.append("Conduit \"").append(getConduitName())
-                        .append("\" Transmit cached message to: ")
-                        .append(url)
-                        .append(": ");
-                    cachedStream.writeCacheTo(b, 16L * 1024L);
-                    LOG.fine(b.toString());
+                    LOG.fine("Conduit \"" + getConduitName()
+                        + "\" Transmit cached message to: "
+                        + url + ": ("
+                        + cachedStream.size() + " bytes)");
                 }