oscerd opened a new pull request, #24984: URL: https://github.com/apache/camel/pull/24984
### Motivation [CAMEL-24210](https://issues.apache.org/jira/browse/CAMEL-24210): a credential passed through a hyphenated or `Authorization`-style endpoint parameter/header name is written in **clear text** wherever a sanitized endpoint URI is emitted (logs, JMX attributes, exception messages, developer console), even though the camelCase `apiKey` option is already redacted. Root cause: `URISupport.sanitizeUri` is regex/keyword-driven and, unlike `SensitiveUtils.containsSensitive` (which strips dashes before matching), matches the raw parameter name. So: | URI parameter | Masked before | Masked after | |---|---|---| | `apiKey=...` | yes | yes | | `additionalHeader.api-key=...` (Azure OpenAI auth header) | **no** | yes | | `additionalHeader.Authorization=...` | **no** | yes | `api-key` is precisely the shape `camel-openai`'s `additionalHeader` option documentation recommends, so the recommended form was the one not redacted. This is **hardening / defence in depth**, not a framework vulnerability — the route author placing the secret in the URI is fully trusted under the threat model; no untrusted input crosses a boundary. Filed and fixed as a normal improvement. The concern is that Camel already redacts `apiKey`, so users reasonably expect credentials in endpoint URIs to be masked. ### Changes - Add `api-key` and `authorization` to the sensitive-keyword generator's `EXTRA_KEYS` (`UpdateSensitizeHelper`), and regenerate `SensitiveUtils` + `sensitive-keys.json`. `api-key` is intentionally dashed: the `sanitizeUri` regex path (wrapped in `\Q...\E`) needs the literal hyphen, whereas the dash-stripping `containsSensitive` path already handled it. The generator comment is updated to explain this exception to the "no dash" convention. - Unit tests in `URISupportTest` for both the hyphenated `api-key` and the `Authorization` header (AssertJ, package-private per the current test conventions). - Upgrade-guide entry noting the added redaction **and** the small, fail-safe over-match: because matching is a case-insensitive substring, non-secret names containing `authorization` (`adjustAuthorization`, `jwtAuthorizationType`, `proxyAuthorizationPolicy`) now also show `xxxxxx` in sanitized URIs — a cosmetic change to sanitized output only. No `camel-openai` change is needed: with `api-key` now redacted, the option's documented example is no longer steering users toward an unredacted shape. ### Testing - `mvn test -Dtest=URISupportTest` in `core/camel-util`: 54 tests pass (incl. 2 new). - Full reactor `mvn clean install -DskipTests` from root: success; `SensitiveUtils`/`sensitive-keys.json` regenerated with only the two additions (no unrelated drift). Main-only (4.22.0): defence-in-depth improvement, no backport. _Claude Code on behalf of Andrea Cosentino (@oscerd)._ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
