[
https://issues.apache.org/jira/browse/TOMEE-4604?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Markus Jung resolved TOMEE-4604.
--------------------------------
Assignee: Krzysztof Śmigrodzki
Resolution: Fixed
> Client's HttpConnectionFactory does not strip sslTruststorePassword from
> outgoing request.
> ------------------------------------------------------------------------------------------
>
> Key: TOMEE-4604
> URL: https://issues.apache.org/jira/browse/TOMEE-4604
> Project: TomEE
> Issue Type: Improvement
> Components: TomEE Core Server
> Affects Versions: 10.1.5
> Reporter: Krzysztof Śmigrodzki
> Assignee: Krzysztof Śmigrodzki
> Priority: Minor
> Fix For: 11.0.0, 10.1.6
>
> Attachments: HttpConnectionFactory.patch
>
> Time Spent: 2h
> Remaining Estimate: 0h
>
> Professional paranoids of my security team twisted my arm to enable mutual
> TLS authentication between OpenEJB client, and remote EJBs on TomEE server.
> I've managed to came up with the following Context.PROVIDER_URL:
> [https://my.tomee.server:8443/tomee/ejb?sslTrustStoreType=PKCS12&sslTrustStorePassword=changeit&sslTrustStore=/location/server-ca.pfx&sslKeyStoreType=PKCS12&sslKeyStorePassword=changeit&sslKeyStore=/location/client.pfx]
>
> The problem is, that in server's access log, I get entries similar to:
> {{127.0.0.1 - - [03/May/2026:15:26:34 +0200] "POST
> /tomee/ejb?sslTrustStoreType=PKCS12&{*}sslTrustStorePassword=changeit{*}&sslTrustStore=/location/server-ca.pfx&sslKeyStoreType=PKCS12&{*}sslKeyStorePassword=changeit{*}&sslKeyStore=/location/client.pfx
> HTTP/1.1" 200 194}}
>
> Now my security team is all in arms about logging passwords.
>
> As far as I understand problem, the constructor of class
> org.apache.openejb.client.HttpConnectionFactory$HttpConnection , in lines
> 92-99 removes parameters `basic.password`, `authorization` from outgoing URL,
> but it keeps SSL related parameters intact. This outgoing URL is received on
> the server and logged.
>
> I propose replacing private String stripQuery(String, String) with a method
> similar to the following:
> {code:java}
> private String stripQuery(final String url, final String []params) {
> final int queryStartIndex = url.indexOf('?');
> if (queryStartIndex < 0) { return url; }
> if (queryStartIndex + 1 == url.length()) { return url.substring(0,
> queryStartIndex); }
> final StringBuilder sb = new StringBuilder();
> for (String param : url.substring(queryStartIndex+1).split("&")) {
> final int p = param.indexOf('=');
> if ((p < 0 && Arrays.binarySearch(params, param) < 0)
> || (p > 0 && Arrays.binarySearch(params, param.substring(0, p)) <
> 0)) {
> if (!sb.isEmpty()) { sb.append('&'); }
> sb.append(param);
> }
> }
> return url.substring(0, queryStartIndex) + (sb.isEmpty() ? "" : "?" + sb);
> } {code}
> And calling it with a static array of sorted query params to be omited i.e.:
> {code:java}
> // Alphabetically sorted list of query params to strip from outgoing URL
> private final static String []PARAMS_TO_STRIP = new String[]{"authorization",
> "authorizationHeader", "basic.password", "basic.username", "connectTimeout",
> "readTimeout", "sslKeyStore", "sslKeyStorePassword", "sslKeyStoreType",
> "sslTrustStore", "sslTrustStorePassword", "sslTrustStoreType"};
> // ...
> final String newUrl = stripQuery(url.toExternalForm(), PARAMS_TO_STRIP);
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
