[
https://issues.apache.org/jira/browse/CXF-8985?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Erich Mauerböck updated CXF-8985:
---------------------------------
Description:
Recently I tried to switch away from the deprecated
{{org.apache.cxf.interceptor}} Logging interceptors to the separate
{{cxf-rt-features-logging}} module, realizing that I could also switch to the
org.apache.cxf.ext.logging.LoggingFeature eliminating the need for explicitly
configuring interceptors as described in
[https://cxf.apache.org/docs/message-logging.html]
I also wanted to replace my proprietary sensitive masking implementation by a
customized intended {{org.apache.cxf.ext.logging.MaskSensitiveHelper}}.
But I noticed that this only worked for sensitive elements, not for sensitive
protocol header names, as {{MaskSensitiveHelper.maskHeaders()}} never gets
called. Instead, headers masking is done by
{{org.apache.cxf.ext.logging.event.DefaultLogEventMapper}}, which is final in
{{org.apache.cxf.ext.logging.AbstractLoggingInterceptor}}, therefore cannot be
changed. In turn, {{MaskSensitiveHelper}} in {{DefaultLogEventMapper}} is also
not changeable (no setter).
This behaviour cannot have been intended that way.
was:
Recently I tried to switch away from the deprecated org.apache.cxf.interceptor
Logging interceptors to the separate cxf-rt-features-logging module, realizing
that I could also switch to the org.apache.cxf.ext.logging.LoggingFeature
eliminating the need for explicitly configuring interceptors as described in
[https://cxf.apache.org/docs/message-logging.html]
I also wanted to replace my proprietary sensitive masking implementation by a
customized intended org.apache.cxf.ext.logging.MaskSensitiveHelper.
But I noticed that this only worked for sensitive elements, not for sensitive
protocol header names, as MaskSensitiveHelper.maskHeaders() never gets called.
Instead, headers masking is done by
org.apache.cxf.ext.logging.event.DefaultLogEventMapper, which is final in
org.apache.cxf.ext.logging.AbstractLoggingInterceptor, therefore cannot be
changed. In turn, MaskSensitiveHelper in DefaultLogEventMapper is also not
changeable (no setter).
This behaviour cannot have been intended that way.
> headers masking implementation not replaceable
> ----------------------------------------------
>
> Key: CXF-8985
> URL: https://issues.apache.org/jira/browse/CXF-8985
> Project: CXF
> Issue Type: Bug
> Components: logging
> Affects Versions: 3.5.7
> Environment: OpenJDK 1.8.0_382
> CentOS 7
> Tomcat 8.5.57
> Spring 4.3.30.RELEASE
> Reporter: Erich Mauerböck
> Priority: Major
>
> Recently I tried to switch away from the deprecated
> {{org.apache.cxf.interceptor}} Logging interceptors to the separate
> {{cxf-rt-features-logging}} module, realizing that I could also switch to the
> org.apache.cxf.ext.logging.LoggingFeature eliminating the need for explicitly
> configuring interceptors as described in
> [https://cxf.apache.org/docs/message-logging.html]
> I also wanted to replace my proprietary sensitive masking implementation by a
> customized intended {{org.apache.cxf.ext.logging.MaskSensitiveHelper}}.
>
> But I noticed that this only worked for sensitive elements, not for sensitive
> protocol header names, as {{MaskSensitiveHelper.maskHeaders()}} never gets
> called. Instead, headers masking is done by
> {{org.apache.cxf.ext.logging.event.DefaultLogEventMapper}}, which is final in
> {{org.apache.cxf.ext.logging.AbstractLoggingInterceptor}}, therefore cannot
> be changed. In turn, {{MaskSensitiveHelper}} in {{DefaultLogEventMapper}} is
> also not changeable (no setter).
> This behaviour cannot have been intended that way.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
