Re: [PR] WW-5635 Avoid logging sensitive token values in TokenHelper [struts]

["lukaszlenart (via GitHub)" <gi...@apache.org>]

lukaszlenart commented on PR #1738:
URL: https://github.com/apache/struts/pull/1738#issuecomment-4702394173

   Thanks for the hardening — the production behavior (dropping the session token from the WARN) is the right call, and logging full detail only under devMode is consistent with how `ParametersInterceptor` already does it.
   
   One blocker though: `ActionContext.getContext().isDevMode()` won't compile — `ActionContext` has no `isDevMode()` method. That accessor lives on `Dispatcher`, and within a static utility like `TokenHelper` the way to reach it is `Dispatcher.getInstance()`:
   
   ```java
   Dispatcher dispatcher = Dispatcher.getInstance();
   if (dispatcher != null && dispatcher.isDevMode()) {
       LOG.warn("Token mismatch detail - token name [{}], form token [{}], session token [{}]",
               normalizeSpace(tokenName), normalizeSpace(token), sessionToken);
   }
   ```
   
   `Dispatcher.getInstance()` is thread-local-backed and populated during request processing, so it's available here — but keep the null guard since `TokenHelper` has no DI.
   
   Minor: the PR description says the extra line is DEBUG-level and logs only boolean presence, but the code logs full values at WARN under devMode. The code is fine given the devMode gate — just worth updating the description so it matches the intent.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org