[jira] [Resolved] (CXF-9083) HTTPConduit prints POST all form parameters to the debug log when handleRedirects

["Freeman Yue Fang (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CXF-9083?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Freeman Yue Fang resolved CXF-9083.
-----------------------------------
    Fix Version/s: 3.6.14
                   4.2.5
                   4.1.10
       Resolution: Fixed

> HTTPConduit prints POST all form parameters to the debug log when handleRedirects
> ---------------------------------------------------------------------------------
>
>                 Key: CXF-9083
>                 URL: https://issues.apache.org/jira/browse/CXF-9083
>             Project: CXF
>          Issue Type: Bug
>    Affects Versions: 3.5.9, 3.6.4
>            Reporter: Dmytro Sylaiev
>            Assignee: Freeman Yue Fang
>            Priority: Major
>             Fix For: 3.6.14, 4.2.5, 4.1.10
>
>
> When execute WebClient::invoke("POST", javax.ws.rs.core.Form) all Form parameters are printed out to the debug log despite it might contain some sensitive data. LoggingFeature does not filter or mask it since it can be used only to mask response body JSON or XML as I understand from the reply on CXF-9070
>  
> In the end I have the log debug message
> {noformat}
> [DEBUG] 16:30:15 org.apache.cxf.transport.http.HTTPConduit- Conduit "{%URL%}WebClient.http-conduit" Transmit cached message to: %URL%: param1...paramN&client_secret=SECRET_DATA{noformat}
> where SECRET_DATA should not be printed. What I see in the code, there's no way to filter it out or mask in any way and in my opinion, it should be fixed.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)