davsclaus commented on code in PR #25113:
URL: https://github.com/apache/camel/pull/25113#discussion_r3651965481
##########
core/camel-util/src/main/java/org/apache/camel/util/SensitiveUtils.java:
##########
@@ -21,9 +21,30 @@
import java.util.HashSet;
import java.util.Locale;
import java.util.Set;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
public final class SensitiveUtils {
+ /**
+ * Matches URI userinfo credentials ({@code scheme://user:password@host}
or {@code scheme://:password@host}) and
+ * captures the password as group 2. The scheme may contain {@code +} /
{@code .} / {@code -} (e.g.
+ * {@code mongodb+srv}). Does not match user-only userinfo without a
password ({@code scheme://user@host}).
+ * <p>
Review Comment:
`URISupport.java` (line 67) already has a field named `USERINFO_PASSWORD`
with a different regex. Having two static patterns with the same name in
different classes doing subtly different things will confuse future
maintainers. Consider renaming this one (e.g. `USERINFO_PASSWORD_IN_TEXT`) or
reconciling the two.
##########
core/camel-util/src/main/java/org/apache/camel/util/SensitiveUtils.java:
##########
@@ -256,4 +277,54 @@ public static boolean containsSensitive(String text) {
return SENSITIVE_KEYS.contains(text);
}
+ /**
+ * Masks passwords embedded in URI userinfo ({@code
scheme://user:password@host}) within free text. Complements
+ * name-based secret detection: the password has no {@code password=} key,
so key/value maskers never see it.
+ * <p>
+ * Query-parameter forms such as {@code ?password=secret} are not handled
here; use a key/value masker or
+ * {@link URISupport#sanitizeUri(String)} for those.
+ *
+ * @param source the text that may contain connection-string style URIs
+ * @param mask the replacement string for the password (for example
{@code xxxxx})
+ * @return the source with userinfo passwords replaced, or the
original source when null/empty or when mask
+ * is null
+ */
Review Comment:
This should have a fast `String.contains("://")` guard before invoking the
regex — the old masking code deliberately avoided regex overhead for the common
case (most log messages don't contain URI schemes):
```suggestion
public static String maskUserInfoCredentials(String source, String mask)
{
if (source == null || source.isEmpty() || mask == null) {
return source;
}
if (!source.contains("://")) {
return source;
}
return USERINFO_PASSWORD.matcher(source).replaceAll("$1" +
Matcher.quoteReplacement(mask) + "$3");
}
```
##########
core/camel-util/src/main/java/org/apache/camel/util/SensitiveUtils.java:
##########
@@ -256,4 +277,54 @@ public static boolean containsSensitive(String text) {
return SENSITIVE_KEYS.contains(text);
}
+ /**
+ * Masks passwords embedded in URI userinfo ({@code
scheme://user:password@host}) within free text. Complements
+ * name-based secret detection: the password has no {@code password=} key,
so key/value maskers never see it.
+ * <p>
+ * Query-parameter forms such as {@code ?password=secret} are not handled
here; use a key/value masker or
+ * {@link URISupport#sanitizeUri(String)} for those.
+ *
+ * @param source the text that may contain connection-string style URIs
+ * @param mask the replacement string for the password (for example
{@code xxxxx})
+ * @return the source with userinfo passwords replaced, or the
original source when null/empty or when mask
+ * is null
+ */
+ public static String maskUserInfoCredentials(String source, String mask) {
+ if (source == null || source.isEmpty() || mask == null) {
+ return source;
+ }
+ return USERINFO_PASSWORD.matcher(source).replaceAll("$1" +
Matcher.quoteReplacement(mask) + "$3");
+ }
+
+ /**
+ * Masks the body of PEM private-key blocks within free text, keeping the
BEGIN/END markers. Public keys and
+ * certificates ({@code BEGIN PUBLIC KEY}, {@code BEGIN CERTIFICATE}) are
left unchanged.
+ *
+ * @param source the text that may contain PEM private-key material
+ * @param mask the replacement string for the key body (for example
{@code xxxxx})
+ * @return the source with private-key bodies replaced, or the
original source when null/empty or when mask
+ * is null
Review Comment:
Same here — add a fast `String.contains("-----BEGIN")` guard before the
regex:
```suggestion
public static String maskPemPrivateKeyBlocks(String source, String mask)
{
if (source == null || source.isEmpty() || mask == null) {
return source;
}
if (!source.contains("-----BEGIN")) {
return source;
}
return PEM_PRIVATE_KEY.matcher(source).replaceAll("$1" +
Matcher.quoteReplacement(mask) + "$3");
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
