Dogface2k opened a new pull request, #13768:
URL: https://github.com/apache/cloudstack/pull/13768

   ### Description
   
   This PR fixes object storage creation from the UI by submitting 
`addObjectStoragePool` as a form-encoded POST request instead of a GET request.
   
   The object-storage form carries provider access and secret keys in indexed 
`details` parameters. Sending those parameters with GET both fails when POST 
enforcement is enabled and places credentials in the request URL. The UI now 
uses the existing `postAPI` transport, preserving the command and parameter 
names while moving them into the request body.
   
   The server-side request classification is hardened at the same boundary:
   
   - `addObjectStoragePool` is marked as containing sensitive request 
information;
   - debug logging suppresses POST parameters for this command, matching the 
existing handling for credential-bearing infrastructure commands;
   - the existing logging decision was extracted without changing its behavior 
for ordinary commands or requests containing user data.
   
   No object-store discovery, provider, persistence, response, or authorization 
behavior is changed.
   
   Fixes: #13679
   
   ### Types of changes
   
   - [ ] Breaking change (fix or feature that would cause existing 
functionality to change)
   - [ ] New feature (non-breaking change which adds functionality)
   - [x] Bug fix (non-breaking change which fixes an issue)
   - [ ] Enhancement (improves an existing feature and functionality)
   - [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
   - [ ] Build/CI
   - [ ] Test (unit or integration test code)
   
   ### Feature/Enhancement Scale or Bug Severity
   
   #### Feature/Enhancement Scale
   
   - [ ] Major
   - [ ] Minor
   
   #### Bug Severity
   
   - [ ] BLOCKER
   - [ ] Critical
   - [x] Major
   - [ ] Minor
   - [ ] Trivial
   
   ### Screenshots (if appropriate):
   
   Not applicable.
   
   ### How Has This Been Tested?
   
   Regression coverage was added for both request transport and credential 
handling:
   
   - the UI test verifies a single POST to `/`, no query-parameter payload, and 
preservation of the indexed access-key and secret-key fields in the form body;
   - the UI test verifies API failures remain propagated to the existing error 
path;
   - the servlet tests verify object-storage POST fields are not logged while 
ordinary POST logging and the existing user-data suppression behavior remain 
unchanged;
   - the API command test verifies the request is classified as containing 
sensitive information.
   
   The complete patch passes `git diff --check` and source-contract checks. The 
branch is initially opened as a draft so the repository's Java 17 and Node 16 
workflows can provide the authoritative build, lint, and test results before it 
is marked ready.
   
   ### How did you try to break this feature and the system with this change?
   
   The transport test includes both credential fields using their real indexed 
parameter names and explicitly asserts that Axios receives no `params` object, 
preventing an accidental fallback to the URL query string. A rejected API 
request is also exercised to ensure the component does not swallow backend 
errors.
   
   Server-side negative controls cover a non-sensitive command and a user-data 
request, proving the logging change does not disable parameter logging globally 
or bypass the existing sensitive user-data rule. The production logging 
predicate remains logically identical for every existing command; only 
`addObjectStoragePool` is added to the established no-parameter-logging set.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to