(shenyu) branch master updated: fix: Remove appSecret from sandbox-beforesign response header[#6402] (#6417)

[liuhongyu]

This is an automated email from the ASF dual-hosted git repository.

Aias00 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/shenyu.git


The following commit(s) were added to refs/heads/master by this push:
     new 281bc61d80 fix: Remove appSecret from sandbox-beforesign response 
header[#6402] (#6417)
281bc61d80 is described below

commit 281bc61d80aeb73e32e16e84681314af2204646d
Author: hengyuss <81064732+hengy...@users.noreply.github.com>
AuthorDate: Tue Jul 7 19:17:58 2026 +0800

    fix: Remove appSecret from sandbox-beforesign response header[#6402] (#6417)
    
    Co-authored-by: aias00 <liuhon...@apache.org>
---
 .../admin/service/impl/SandboxServiceImpl.java     | 10 +++++---
 .../admin/service/impl/SandboxServiceImplTest.java | 30 ++++++++++++++++++++++
 2 files changed, 36 insertions(+), 4 deletions(-)

diff --git 
a/shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/SandboxServiceImpl.java
 
b/shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/SandboxServiceImpl.java
index e0315584f0..da9e819ddf 100644
--- 
a/shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/SandboxServiceImpl.java
+++ 
b/shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/SandboxServiceImpl.java
@@ -90,13 +90,12 @@ public class SandboxServiceImpl implements SandboxService {
             throw new ShenyuException(proxyHostPort + " is not allowed.");
         }
 
-        String signContent = null;
         String sign = null;
+        String timestamp = String.valueOf(Instant.now().toEpochMilli());
         if (StringUtils.isNotEmpty(appKey)) {
-            String timestamp = String.valueOf(Instant.now().toEpochMilli());
             String secureKey = getSecureKey(appKey);
             Assert.notBlack(secureKey, Constants.SIGN_APP_KEY_IS_NOT_EXIST);
-            signContent = ShenyuSignatureUtils.getSignContent(secureKey, 
timestamp, uriComponents.getPath());
+            String signContent = 
ShenyuSignatureUtils.getSignContent(secureKey, timestamp, 
uriComponents.getPath());
             sign = ShenyuSignatureUtils.generateSign(signContent);
             header.put("timestamp", timestamp);
             header.put("appKey", appKey);
@@ -114,7 +113,10 @@ public class SandboxServiceImpl implements SandboxService {
                 return;
             }
             if (StringUtils.isNotEmpty(appKey)) {
-                response.addHeader("sandbox-beforesign", 
UriUtils.encode(signContent, StandardCharsets.UTF_8));
+                String signContentWithoutSecret = "path" + 
uriComponents.getPath()
+                        + "timestamp" + timestamp
+                        + "version" + ShenyuSignatureUtils.VERSION;
+                response.addHeader("sandbox-beforesign", 
UriUtils.encode(signContentWithoutSecret, StandardCharsets.UTF_8));
                 response.addHeader("sandbox-sign", UriUtils.encode(sign, 
StandardCharsets.UTF_8));
             }
 
diff --git 
a/shenyu-admin/src/test/java/org/apache/shenyu/admin/service/impl/SandboxServiceImplTest.java
 
b/shenyu-admin/src/test/java/org/apache/shenyu/admin/service/impl/SandboxServiceImplTest.java
index a0d1db0f4d..b2d9860712 100644
--- 
a/shenyu-admin/src/test/java/org/apache/shenyu/admin/service/impl/SandboxServiceImplTest.java
+++ 
b/shenyu-admin/src/test/java/org/apache/shenyu/admin/service/impl/SandboxServiceImplTest.java
@@ -25,6 +25,7 @@ import java.nio.charset.StandardCharsets;
 import java.util.Collections;
 
 import org.apache.shenyu.admin.model.dto.ProxyGatewayDTO;
+import org.apache.shenyu.admin.model.entity.AppAuthDO;
 import org.apache.shenyu.admin.model.vo.ShenyuDictVO;
 import org.apache.shenyu.admin.service.AppAuthService;
 import org.apache.shenyu.admin.service.ShenyuDictService;
@@ -69,6 +70,35 @@ final class SandboxServiceImplTest {
         }
     }
 
+    @Test
+    void requestProxyGatewayShouldNotExposeAppSecretInBeforeSignHeader() 
throws IOException {
+        HttpServer server = startHttpServer("proxied response");
+        int port = server.getAddress().getPort();
+        SandboxServiceImpl sandboxService = new 
SandboxServiceImpl(appAuthService, shenyuDictService);
+
+        
when(shenyuDictService.list(anyString())).thenReturn(Collections.singletonList(buildDict(port)));
+
+        String testAppKey = "testAppKey";
+        String testAppSecret = "testSecret123";
+        AppAuthDO appAuthDO = new AppAuthDO(testAppKey, testAppSecret, true, 
true, null, null, null, null);
+        when(appAuthService.findByAppKey(testAppKey)).thenReturn(appAuthDO);
+
+        try {
+            MockHttpServletResponse response = new MockHttpServletResponse();
+            ProxyGatewayDTO dto = buildProxyGatewayDTO(port);
+            dto.setAppKey(testAppKey);
+            sandboxService.requestProxyGateway(dto, new 
MockHttpServletRequest(), response);
+
+            String beforesign = response.getHeader("sandbox-beforesign");
+            assertThat(beforesign).doesNotContain(testAppSecret);
+
+            String sign = response.getHeader("sandbox-sign");
+            assertThat(sign).isNotNull();
+        } finally {
+            server.stop(0);
+        }
+    }
+
     private ProxyGatewayDTO buildProxyGatewayDTO(final int port) {
         ProxyGatewayDTO proxyGatewayDTO = new ProxyGatewayDTO();
         proxyGatewayDTO.setRequestUrl("http://localhost:"; + port + "/proxy");