github-advanced-security[bot] commented on code in PR #3598:
URL: https://github.com/apache/cxf/pull/3598#discussion_r4316822028
##########
rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/persistence/PersistenceUtils.java:
##########
@@ -103,22 +119,146 @@
return context;
}
+ /**
+ * Content type of the SOAP root message (without the multipart wrapper),
or null if unknown.
+ * Captured outbound messages provide it via SAVED_CONTENT_TYPE; for
inbound multipart
+ * messages it is taken from the headers of the root part. The result is
never a multipart type,
+ * as the multipart wrapper is recreated when the message is written, so a
multipart type would
+ * end up nested into another multipart message.
+ */
+ private static String getRootContentType(Message msg) {
+ String ct = (String)msg.get(RMMessageConstants.SAVED_CONTENT_TYPE);
+ if (ct == null) {
+ Map<String, List<String>> ih =
+ CastUtils.cast((Map<?,
?>)msg.get(AttachmentDeserializer.ATTACHMENT_PART_HEADERS));
+ List<String> types = ih != null ? ih.get("Content-Type") : null;
+ if (types != null && !types.isEmpty()) {
+ // the charset is added again by the AttachmentSerializer when
the message is written
+ ct = removeCharset(types.get(0));
+ }
+ }
+ if (ct == null) {
+ ct = (String) msg.get(Message.CONTENT_TYPE);
+ }
+ if (isMultipart(ct)) {
+ return getMultipartRootType(ct);
+ }
+ return ct;
+ }
+
+ /**
+ * Content type of the root part of a multipart message of the given type,
used when the multipart
+ * type is the only known type, like when it was stored as the type of the
root part. The start-info
+ * parameter written by the AttachmentSerializer holds the SOAP content
type with its parameters,
+ * like the SOAP 1.2 action, and the type parameter is the one of the root
part, application/xop+xml
+ * for an XOP package.
+ */
+ private static String getMultipartRootType(String multipartType) {
+ String rootType = null;
+ try {
+ MimeType mt = new MimeType(multipartType);
+ String type = mt.getParameter("type");
+ String startInfo = mt.getParameter("start-info");
+ if (XOP_CONTENT_TYPE.equalsIgnoreCase(type)) {
+ MimeType xop = new MimeType(XOP_CONTENT_TYPE);
+ if (startInfo != null) {
+ xop.setParameter("type", removeCharset(startInfo));
+ }
+ rootType = xop.toString();
+ } else {
+ String soapType = startInfo != null ? startInfo : type;
+ if (soapType != null && !isMultipart(soapType)) {
+ rootType = removeCharset(soapType);
+ }
+ }
+ } catch (MimeTypeParseException e) {
+ LOG.log(Level.FINE, "Invalid multipart Content-Type " +
multipartType, e);
Review Comment:
## CodeQL / Insertion of sensitive information into log files
This [potentially sensitive information](1) is written to a log file.
[Show more
details](https://github.com/apache/cxf/security/code-scanning/2254)
##########
rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/persistence/PersistenceUtils.java:
##########
@@ -103,22 +119,146 @@
return context;
}
+ /**
+ * Content type of the SOAP root message (without the multipart wrapper),
or null if unknown.
+ * Captured outbound messages provide it via SAVED_CONTENT_TYPE; for
inbound multipart
+ * messages it is taken from the headers of the root part. The result is
never a multipart type,
+ * as the multipart wrapper is recreated when the message is written, so a
multipart type would
+ * end up nested into another multipart message.
+ */
+ private static String getRootContentType(Message msg) {
+ String ct = (String)msg.get(RMMessageConstants.SAVED_CONTENT_TYPE);
+ if (ct == null) {
+ Map<String, List<String>> ih =
+ CastUtils.cast((Map<?,
?>)msg.get(AttachmentDeserializer.ATTACHMENT_PART_HEADERS));
+ List<String> types = ih != null ? ih.get("Content-Type") : null;
+ if (types != null && !types.isEmpty()) {
+ // the charset is added again by the AttachmentSerializer when
the message is written
+ ct = removeCharset(types.get(0));
+ }
+ }
+ if (ct == null) {
+ ct = (String) msg.get(Message.CONTENT_TYPE);
+ }
+ if (isMultipart(ct)) {
+ return getMultipartRootType(ct);
+ }
+ return ct;
+ }
+
+ /**
+ * Content type of the root part of a multipart message of the given type,
used when the multipart
+ * type is the only known type, like when it was stored as the type of the
root part. The start-info
+ * parameter written by the AttachmentSerializer holds the SOAP content
type with its parameters,
+ * like the SOAP 1.2 action, and the type parameter is the one of the root
part, application/xop+xml
+ * for an XOP package.
+ */
+ private static String getMultipartRootType(String multipartType) {
+ String rootType = null;
+ try {
+ MimeType mt = new MimeType(multipartType);
+ String type = mt.getParameter("type");
+ String startInfo = mt.getParameter("start-info");
+ if (XOP_CONTENT_TYPE.equalsIgnoreCase(type)) {
+ MimeType xop = new MimeType(XOP_CONTENT_TYPE);
+ if (startInfo != null) {
+ xop.setParameter("type", removeCharset(startInfo));
+ }
+ rootType = xop.toString();
+ } else {
+ String soapType = startInfo != null ? startInfo : type;
+ if (soapType != null && !isMultipart(soapType)) {
+ rootType = removeCharset(soapType);
+ }
+ }
+ } catch (MimeTypeParseException e) {
+ LOG.log(Level.FINE, "Invalid multipart Content-Type " +
multipartType, e);
Review Comment:
## CodeQL / Log Injection
This log entry depends on a [user-provided value](1).
This log entry depends on a [user-provided value](2).
This log entry depends on a [user-provided value](3).
[Show more
details](https://github.com/apache/cxf/security/code-scanning/2255)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
