[jira] [Commented] (CAMEL-24973) camel-util - URISupport.sanitizeUri does not follow the endpoint URI parser for RAW values, userinfo, dash-case option names and additional keywords

["Claus Ibsen (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/CAMEL-24973?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18120280#comment-18120280 ] 

Claus Ibsen commented on CAMEL-24973:
-------------------------------------

Upgrade-guide notes for 4.22.2 and 4.18.5 merged to main via https://github.com/apache/camel/pull/26963 (commit 6b0d41aac1e2c497b7cbb47c8a5a224f6107f2a2). Left In Progress: the camel-4.22.x backport https://github.com/apache/camel/pull/26895 is still open and must land before 4.22.2.

_Claude Code on behalf of davsclaus_

> camel-util - URISupport.sanitizeUri does not follow the endpoint URI parser for RAW values, userinfo, dash-case option names and additional keywords
> ----------------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24973
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24973
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-core
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Minor
>             Fix For: 4.23.0
>
>
> URISupport.sanitizeUri() masks option values with regular expressions that do not always match how Camel parses and binds endpoint URIs, so some values are only partly masked or not masked:
> * RAW values: the sanitizer ends RAW(...) and RAW\{...\} at the first closing bracket, while URIScanner ends them at a closing bracket followed by & or the end of the string (see URISupportTest#testParseQuery). EndpointUriFactorySupport and YamlSupport wrap secret options in RAW() automatically.
> * Userinfo: USERINFO_PASSWORD is not limited to the authority component, so when a later part of the string contains another :// and @ the wrong segment is replaced.
> * Option names: names are matched literally against the sensitive keywords, but property binding also accepts dash-case names (PropertyBindingSupport.undashKey) and SensitiveUtils.containsSensitive() ignores '-' (CAMEL-16146). Dash-case forms such as connection-string, private-key, shared-access-key or sasl-jaas-config are not masked.
> * addSanitizeKeywords() (CAMEL-22365): the extra pattern is applied with replaceFirst, each call replaces the previously added keywords although the javadoc says they are added, and a call with only built-in keywords compiles an empty alternation.
> Related: DefaultComponent.validateParameters(), ScheduledPollConsumer and JettyHttpComponent12 list unknown parameters with their values ("Unknown parameters=\[...\]") without applying the same masking.
> Proposed change: align RAW termination with URIScanner, scope the userinfo match to the authority, normalize option names before keyword matching, apply additional keywords to every match and accumulate them, mask sensitive values in the unknown-parameters message, and add URISupportTest coverage for each case.
> _Claude Code on behalf of oscerd_



--
This message was sent by Atlassian Jira
(v8.20.10#820010)