[GitHub] [sling-org-apache-sling-discovery-base] github-code-scanning[bot] commented on a diff in pull request #7: SLING-11355: sling discovery bundles: update to sling parent 48

[GitBox <gi...@apache.org>]

github-code-scanning[bot] commented on code in PR #7:
URL: https://github.com/apache/sling-org-apache-sling-discovery-base/pull/7#discussion_r899073433


##########
src/main/java/org/apache/sling/discovery/base/connectors/ping/TopologyConnectorServlet.java:
##########
@@ -206,39 +204,35 @@
         }
 
         final String[] pathInfo = request.getPathInfo().split("\\.");
-        final String extension = pathInfo.length==3 ? pathInfo[2] : "";
+        final String extension = pathInfo.length == 3 ? pathInfo[2] : "";
         if (!"json".equals(extension)) {
             response.sendError(HttpServletResponse.SC_NOT_FOUND);
             return;
         }
-        
-        final String selector = pathInfo.length==3 ? pathInfo[1] : "";
+
+        final String selector = pathInfo.length == 3 ? pathInfo[1] : "";
 
         String topologyAnnouncementJSON = requestValidator.decodeMessage(request);
-    	if (logger.isDebugEnabled()) {
-	        logger.debug("doPost: incoming topology announcement is: "
-	                + topologyAnnouncementJSON);
-    	}
+        logger.debug("doPost: incoming topology announcement is: " + topologyAnnouncementJSON);

Review Comment:
   ## Logging should not be vulnerable to injection attacks
   
   <!--SONAR_ISSUE_KEY:AYB1ES3ffTAwqewx7xx1-->Change this code to not log user-controlled data.
   
   [Show more details](https://github.com/apache/sling-org-apache-sling-discovery-base/security/code-scanning/2)



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org