You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by re...@apache.org on 2024/11/24 19:03:00 UTC
(cxf) 04/05: CXF-9082: Allow to modify sensitive header list (refactor the methods to accept lists instead of message instance)
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 4.0.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 5caf6cd35dbbb2b28a7dbfa57e074cd96c4239dc
Author: Andriy Redko <dr...@gmail.com>
AuthorDate: Sun Nov 24 13:44:51 2024 -0500
CXF-9082: Allow to modify sensitive header list (refactor the methods to accept lists instead of message instance)
(cherry picked from commit 8e3365871b4c26a4e31a1977d1cffedcdea743d6)
---
.../org/apache/cxf/transport/http/Headers.java | 24 +++++++++++++---------
.../org/apache/cxf/transport/http/HeadersTest.java | 9 ++++----
2 files changed, 19 insertions(+), 14 deletions(-)
diff --git a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/Headers.java b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/Headers.java
index 174d590885..17b29bacc6 100644
--- a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/Headers.java
+++ b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/Headers.java
@@ -109,11 +109,12 @@ public class Headers {
* filtered keys), so it should be used sparingly - i.e. only when debug is
* enabled.
*/
- static String toString(Message message, boolean logSensitiveHeaders) {
+ static String toString(Map<String, List<Object>> headers, Set<String> sensitiveHeaders,
+ boolean logSensitiveHeaders) {
Map<String, List<Object>> filteredHeaders = new TreeMap<>(String.CASE_INSENSITIVE_ORDER);
- filteredHeaders.putAll(CastUtils.cast(getSetProtocolHeaders(message)));
+ filteredHeaders.putAll(CastUtils.cast(headers));
if (!logSensitiveHeaders) {
- for (String filteredKey : getSensitiveHeaders(message)) {
+ for (String filteredKey : sensitiveHeaders) {
filteredHeaders.put(filteredKey, SENSITIVE_HEADER_MARKER);
}
}
@@ -312,13 +313,13 @@ public class Headers {
* @param logSensitiveHeaders whether to log sensitive headers
*/
static void logProtocolHeaders(Logger logger, Level level,
- Message message,
- boolean logSensitiveHeaders) {
+ Map<String, List<Object>> headersMap,
+ Set<String> sensitiveHeaders,
+ boolean logSensitiveHeaders) {
if (logger.isLoggable(level)) {
- Map<String, List<Object>> headersMap = CastUtils.cast(getSetProtocolHeaders(message));
for (Map.Entry<String, List<Object>> entry : headersMap.entrySet()) {
String key = entry.getKey();
- boolean sensitive = !logSensitiveHeaders && getSensitiveHeaders(message).contains(key);
+ boolean sensitive = !logSensitiveHeaders && sensitiveHeaders.contains(key);
List<Object> headerList = sensitive ? SENSITIVE_HEADER_MARKER : entry.getValue();
for (Object value : headerList) {
logger.log(level, key + ": "
@@ -369,7 +370,8 @@ public class Headers {
transferProtocolHeadersToURLConnection(connection);
- logProtocolHeaders(LOG, Level.FINE, message, logSensitiveHeaders());
+ Map<String, List<Object>> theHeaders = CastUtils.cast(headers);
+ logProtocolHeaders(LOG, Level.FINE, theHeaders, getSensitiveHeaders(), logSensitiveHeaders());
}
public String determineContentType() {
@@ -453,7 +455,9 @@ public class Headers {
headers.put(Message.CONTENT_TYPE, Collections.singletonList(req.getContentType()));
}
if (LOG.isLoggable(Level.FINE)) {
- LOG.log(Level.FINE, "Request Headers: " + toString(message, logSensitiveHeaders()));
+ Map<String, List<Object>> theHeaders = CastUtils.cast(headers);
+ LOG.log(Level.FINE, "Request Headers: " + toString(theHeaders, getSensitiveHeaders(),
+ logSensitiveHeaders()));
}
}
@@ -581,7 +585,7 @@ public class Headers {
return locale.toString().replace('_', '-');
}
- static Set<String> getSensitiveHeaders(Message message) {
+ private Set<String> getSensitiveHeaders() {
return MessageUtils.getContextualStrings(message, SENSITIVE_HEADERS_PROP_NAME,
DEFAULT_SENSITIVE_HEADERS);
}
diff --git a/rt/transports/http/src/test/java/org/apache/cxf/transport/http/HeadersTest.java b/rt/transports/http/src/test/java/org/apache/cxf/transport/http/HeadersTest.java
index 537893c6d0..bbcca22099 100755
--- a/rt/transports/http/src/test/java/org/apache/cxf/transport/http/HeadersTest.java
+++ b/rt/transports/http/src/test/java/org/apache/cxf/transport/http/HeadersTest.java
@@ -24,6 +24,7 @@ import java.util.HashMap;
import java.util.List;
import java.util.Locale;
import java.util.Map;
+import java.util.Set;
import java.util.logging.Handler;
import java.util.logging.Level;
import java.util.logging.LogRecord;
@@ -102,7 +103,7 @@ public class HeadersTest {
headerMap.put("Accept", Arrays.asList("text/plain"));
message.put(Message.PROTOCOL_HEADERS, headerMap);
- String loggedString = Headers.toString(message, false);
+ String loggedString = Headers.toString(headerMap, Set.of("Authorization", "Proxy-Authorization"), false);
assertFalse("The value of a sensitive header could be logged: " + loggedString, loggedString.contains("FAIL"));
assertTrue("The value of a non-sensitive header would not be logged: " + loggedString,
loggedString.contains("application/xml") && loggedString.contains("text/plain"));
@@ -119,9 +120,8 @@ public class HeadersTest {
headerMap.put("MyCustomHeader", Arrays.asList("Value1"));
headerMap.put("NotMyCustomHeader", Arrays.asList("Value2"));
message.put(Message.PROTOCOL_HEADERS, headerMap);
- message.put("org.apache.http.sensitive.headers", "Authorization,MyCustomHeader");
- String loggedString = Headers.toString(message, false);
+ String loggedString = Headers.toString(headerMap, Set.of("Authorization", "MyCustomHeader"), false);
assertFalse("The value of a custom sensitive header should not be logged: "
+ loggedString, loggedString.contains("FAIL"));
@@ -183,7 +183,8 @@ public class HeadersTest {
// no-op
} });
- Headers.logProtocolHeaders(logger, Level.INFO, message, false);
+ Headers.logProtocolHeaders(logger, Level.INFO, headerMap,
+ Set.of("Authorization", "Proxy-Authorization"), false);
}
@Test