ruanweihong-aaa commented on PR #14040:
URL: https://github.com/apache/apisix/pull/14040#issuecomment-6329953853
Thanks for the update! The original masking case is fixed in targeted HTTP
integration tests against `5b8b4739`. Two issues remain:
1. `apisix/plugins/data-mask.lua:336–340`:
```lua
if next(args) then
ctx.var.upstream_uri = upstream_path .. "?" ..
core.string.encode_args(args)
else
ctx.var.upstream_uri = upstream_path
end
```
This replaces the upstream query with the masked request args, dropping
parameters added by `proxy-rewrite`. With `uri: /rewritten?fixed=1` and client
query `password=secret&foo=1`, the backend receives
`/rewritten?fixed=1&password=secret&foo=1`, but the log contains
`/rewritten?foo=1`. Please preserve unrelated upstream parameters, including
repeated values. This affects logging, not the forwarded request.
2. `t/router/servlet-upstream-uri.t:148` configures:
```lua
uri = "/data-mask/*",
```
But TEST 8 and TEST 10 (lines 268 and 314) request:
```text
GET /data-mask;jsessionid=x?password=secret
GET /data-mask;jsessionid=x?password=secret&foo=1
```
These normalize to `/data-mask`, miss `/data-mask/*`, and hit the fallback.
With the same routing configuration, both requests returned 200 but produced no
file-logger output; `/data-mask/test;jsessionid=x` matched the intended route
and produced masked logs. Please use an exact `/data-mask` route or update the
requests and assertions to use a child path.
I verified these results with targeted HTTP integration checks comparing
`c1fd74f6` and `5b8b4739`, beyond the earlier function-level checks. I have not
run the complete Test::Nginx suite.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
