jdaugherty commented on PR #16631:
URL: https://github.com/apache/grails-core/pull/16631#issuecomment-6397137136
@jamesfredley re review 5641362789: both items are fixed on head 73c20a13c7.
Path parameters after a semicolon are split off before matching and each is
recorded as `;?`, so `/book/index;jsessionid=abc123secretXYZ` records `GET
/book/index;?`, asserted through the capture API. The MongoDB redactor now
tells conditions, update operators and stored data apart: a `$` key stays an
operator only in a condition, a pipeline or at the top of an update, and in
stored data (inserted documents, replacement documents, values an update
operator writes, `$push`/`$addToSet` elements, `$literal`) it is a field name
recorded as `?` unless mapped; proven against a real mongod with an insert and
a `$set` of `attrs: {"$example-secret": ...}`. Details are in the replies on
your two threads, which I resolved since both are fixed; reopen either to
discuss further.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
