[jira] [Created] (TOMEE-4604) Client's HttpConnectionFactory does not strip sslTruststorePassword from outgoing request.

["Krzysztof Śmigrodzki (Jira)" <ji...@apache.org>]

Krzysztof Śmigrodzki created TOMEE-4604:
-------------------------------------------

             Summary: Client's HttpConnectionFactory does not strip sslTruststorePassword from outgoing request.
                 Key: TOMEE-4604
                 URL: https://issues.apache.org/jira/browse/TOMEE-4604
             Project: TomEE
          Issue Type: Improvement
          Components: TomEE Core Server
            Reporter: Krzysztof Śmigrodzki
         Attachments: HttpConnectionFactory.patch

Professional paranoids of my security team twisted my arm to enable mutual TLS authentication between OpenEJB client, and remote EJBs on TomEE server. I've managed to came up with the following Context.PROVIDER_URL: 
[https://my.tomee.server:8443/tomee/ejb?sslTrustStoreType=PKCS12&sslTrustStorePassword=changeit&sslTrustStore=/location/server-ca.pfx&sslKeyStoreType=PKCS12&sslKeyStorePassword=changeit&sslKeyStore=/location/client.pfx]
 
The problem is, that in server's access log, I get entries similar to:
{{127.0.0.1 - - [03/May/2026:15:26:34 +0200] "POST /tomee/ejb?sslTrustStoreType=PKCS12&{*}sslTrustStorePassword=changeit{*}&sslTrustStore=/location/server-ca.pfx&sslKeyStoreType=PKCS12&{*}sslKeyStorePassword=changeit{*}&sslKeyStore=/location/client.pfx HTTP/1.1" 200 194}}
 
Now my security team is all in arms about logging passwords.
 
As far as I understand problem, the constructor of class  org.apache.openejb.client.HttpConnectionFactory$HttpConnection , in lines 92-99 removes parameters `basic.password`, `authorization` from outgoing URL, but it keeps SSL related parameters intact. This outgoing URL is received on the server and logged.
 
I propose replacing private String stripQuery(String, String) with a method similar to the following:
{code:java}
private String stripQuery(final String url, final String []params) {
    final int queryStartIndex = url.indexOf('?');
    if (queryStartIndex < 0) { return url; }
    if (queryStartIndex + 1 == url.length()) { return url.substring(0, queryStartIndex); }

    final StringBuilder sb = new StringBuilder();
    for (String param : url.substring(queryStartIndex+1).split("&")) {
        final int p = param.indexOf('=');
        if ((p < 0 && Arrays.binarySearch(params, param) < 0)
            || (p > 0 && Arrays.binarySearch(params, param.substring(0, p)) < 0)) {
            if (!sb.isEmpty()) { sb.append('&'); }
            sb.append(param);
        }
    }
    return url.substring(0, queryStartIndex) + (sb.isEmpty() ? "" : "?" + sb);
} {code}
And calling it with a static array of sorted query params to be omited i.e.:
{code:java}
// Alphabetically sorted list of query params to strip from outgoing URL
private final static String []PARAMS_TO_STRIP = new String[]{"authorization", "authorizationHeader", "basic.password", "basic.username", "connectTimeout", "readTimeout", "sslKeyStore", "sslKeyStorePassword", "sslKeyStoreType", "sslTrustStore", "sslTrustStorePassword", "sslTrustStoreType"};

// ...

final String newUrl = stripQuery(url.toExternalForm(), PARAMS_TO_STRIP);
{code}



--
This message was sent by Atlassian Jira
(v8.20.10#820010)