atiaomar1978-hub commented on code in PR #25113:
URL: https://github.com/apache/camel/pull/25113#discussion_r3652904773
##########
core/camel-util/src/main/java/org/apache/camel/util/SensitiveUtils.java:
##########
@@ -256,4 +277,54 @@ public static boolean containsSensitive(String text) {
return SENSITIVE_KEYS.contains(text);
}
+ /**
+ * Masks passwords embedded in URI userinfo ({@code
scheme://user:password@host}) within free text. Complements
+ * name-based secret detection: the password has no {@code password=} key,
so key/value maskers never see it.
+ * <p>
+ * Query-parameter forms such as {@code ?password=secret} are not handled
here; use a key/value masker or
+ * {@link URISupport#sanitizeUri(String)} for those.
+ *
+ * @param source the text that may contain connection-string style URIs
+ * @param mask the replacement string for the password (for example
{@code xxxxx})
+ * @return the source with userinfo passwords replaced, or the
original source when null/empty or when mask
+ * is null
+ */
Review Comment:
Fixed in `77607275443`. Added the `://` fast path exactly as suggested
(`maskUserInfoCredentials` returns early when the source has no URI scheme).
Tests: `maskValueShapeHelpersSkipRegexWhenMarkersAbsent` and
`formatPlainTextUnchanged`.
_AI-generated reply on behalf of @atiaomar1978-hub._
##########
core/camel-util/src/main/java/org/apache/camel/util/SensitiveUtils.java:
##########
@@ -256,4 +277,54 @@ public static boolean containsSensitive(String text) {
return SENSITIVE_KEYS.contains(text);
}
+ /**
+ * Masks passwords embedded in URI userinfo ({@code
scheme://user:password@host}) within free text. Complements
+ * name-based secret detection: the password has no {@code password=} key,
so key/value maskers never see it.
+ * <p>
+ * Query-parameter forms such as {@code ?password=secret} are not handled
here; use a key/value masker or
+ * {@link URISupport#sanitizeUri(String)} for those.
+ *
+ * @param source the text that may contain connection-string style URIs
+ * @param mask the replacement string for the password (for example
{@code xxxxx})
+ * @return the source with userinfo passwords replaced, or the
original source when null/empty or when mask
+ * is null
+ */
+ public static String maskUserInfoCredentials(String source, String mask) {
+ if (source == null || source.isEmpty() || mask == null) {
+ return source;
+ }
+ return USERINFO_PASSWORD.matcher(source).replaceAll("$1" +
Matcher.quoteReplacement(mask) + "$3");
+ }
+
+ /**
+ * Masks the body of PEM private-key blocks within free text, keeping the
BEGIN/END markers. Public keys and
+ * certificates ({@code BEGIN PUBLIC KEY}, {@code BEGIN CERTIFICATE}) are
left unchanged.
+ *
+ * @param source the text that may contain PEM private-key material
+ * @param mask the replacement string for the key body (for example
{@code xxxxx})
+ * @return the source with private-key bodies replaced, or the
original source when null/empty or when mask
+ * is null
Review Comment:
Fixed in `77607275443`. Added a fast path before the PEM regex. The guard
uses `StringHelper.containsIgnoreCase(source, \"-----BEGIN\")` so it stays
consistent with the `CASE_INSENSITIVE` PEM pattern (Bugbot/Grok flagged plain
`contains` missing lowercase headers). Test added for lowercase `-----begin rsa
private key-----`.
_AI-generated reply on behalf of @atiaomar1978-hub._
##########
core/camel-util/src/main/java/org/apache/camel/util/SensitiveUtils.java:
##########
@@ -21,9 +21,30 @@
import java.util.HashSet;
import java.util.Locale;
import java.util.Set;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
public final class SensitiveUtils {
+ /**
+ * Matches URI userinfo credentials ({@code scheme://user:password@host}
or {@code scheme://:password@host}) and
+ * captures the password as group 2. The scheme may contain {@code +} /
{@code .} / {@code -} (e.g.
+ * {@code mongodb+srv}). Does not match user-only userinfo without a
password ({@code scheme://user@host}).
+ * <p>
Review Comment:
Fixed in `77607275443`. Renamed to `URI_USERINFO_PASSWORD_IN_TEXT` and
documented how it differs from `URISupport.USERINFO_PASSWORD` (stricter
free-text rules). Also made the userinfo prefix non-greedy (`*?:`) so passwords
with embedded `:` mask fully, aligned with `URISupport` sanitization.
_AI-generated reply on behalf of @atiaomar1978-hub._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
