This is an automated email from the ASF dual-hosted git repository. reta pushed a commit to branch 3.6.x-fixes in repository https://gitbox.apache.org/repos/asf/cxf.git
commit e7720665528832a45359ca32f407ce60d25e5f2c Author: Andriy Redko <[email protected]> AuthorDate: Sun Nov 24 13:44:51 2024 -0500 CXF-9082: Allow to modify sensitive header list (refactor the methods to accept lists instead of message instance) (cherry picked from commit 8e3365871b4c26a4e31a1977d1cffedcdea743d6) (cherry picked from commit 5caf6cd35dbbb2b28a7dbfa57e074cd96c4239dc) --- .../org/apache/cxf/transport/http/Headers.java | 24 +++++++++++++--------- .../org/apache/cxf/transport/http/HeadersTest.java | 9 ++++---- 2 files changed, 19 insertions(+), 14 deletions(-) diff --git a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/Headers.java b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/Headers.java index bb87ef7b47..070f9f3d76 100644 --- a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/Headers.java +++ b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/Headers.java @@ -110,11 +110,12 @@ public class Headers { * filtered keys), so it should be used sparingly - i.e. only when debug is * enabled. */ - static String toString(Message message, boolean logSensitiveHeaders) { + static String toString(Map<String, List<Object>> headers, Set<String> sensitiveHeaders, + boolean logSensitiveHeaders) { Map<String, List<Object>> filteredHeaders = new TreeMap<>(String.CASE_INSENSITIVE_ORDER); - filteredHeaders.putAll(CastUtils.cast(getSetProtocolHeaders(message))); + filteredHeaders.putAll(CastUtils.cast(headers)); if (!logSensitiveHeaders) { - for (String filteredKey : getSensitiveHeaders(message)) { + for (String filteredKey : sensitiveHeaders) { filteredHeaders.put(filteredKey, SENSITIVE_HEADER_MARKER); } } @@ -313,13 +314,13 @@ public class Headers { * @param logSensitiveHeaders whether to log sensitive headers */ static void logProtocolHeaders(Logger logger, Level level, - Message message, - boolean logSensitiveHeaders) { + Map<String, List<Object>> headersMap, + Set<String> sensitiveHeaders, + boolean logSensitiveHeaders) { if (logger.isLoggable(level)) { - Map<String, List<Object>> headersMap = CastUtils.cast(getSetProtocolHeaders(message)); for (Map.Entry<String, List<Object>> entry : headersMap.entrySet()) { String key = entry.getKey(); - boolean sensitive = !logSensitiveHeaders && getSensitiveHeaders(message).contains(key); + boolean sensitive = !logSensitiveHeaders && sensitiveHeaders.contains(key); List<Object> headerList = sensitive ? SENSITIVE_HEADER_MARKER : entry.getValue(); for (Object value : headerList) { logger.log(level, key + ": " @@ -370,7 +371,8 @@ public class Headers { transferProtocolHeadersToURLConnection(connection); - logProtocolHeaders(LOG, Level.FINE, message, logSensitiveHeaders()); + Map<String, List<Object>> theHeaders = CastUtils.cast(headers); + logProtocolHeaders(LOG, Level.FINE, theHeaders, getSensitiveHeaders(), logSensitiveHeaders()); } public String determineContentType() { @@ -454,7 +456,9 @@ public class Headers { headers.put(Message.CONTENT_TYPE, Collections.singletonList(req.getContentType())); } if (LOG.isLoggable(Level.FINE)) { - LOG.log(Level.FINE, "Request Headers: " + toString(message, logSensitiveHeaders())); + Map<String, List<Object>> theHeaders = CastUtils.cast(headers); + LOG.log(Level.FINE, "Request Headers: " + toString(theHeaders, getSensitiveHeaders(), + logSensitiveHeaders())); } } @@ -582,7 +586,7 @@ public class Headers { return locale.toString().replace('_', '-'); } - static Set<String> getSensitiveHeaders(Message message) { + private Set<String> getSensitiveHeaders() { return MessageUtils.getContextualStrings(message, SENSITIVE_HEADERS_PROP_NAME, DEFAULT_SENSITIVE_HEADERS); } diff --git a/rt/transports/http/src/test/java/org/apache/cxf/transport/http/HeadersTest.java b/rt/transports/http/src/test/java/org/apache/cxf/transport/http/HeadersTest.java index 11f84dd910..6ed84aa749 100755 --- a/rt/transports/http/src/test/java/org/apache/cxf/transport/http/HeadersTest.java +++ b/rt/transports/http/src/test/java/org/apache/cxf/transport/http/HeadersTest.java @@ -24,6 +24,7 @@ import java.util.HashMap; import java.util.List; import java.util.Locale; import java.util.Map; +import java.util.Set; import java.util.logging.Handler; import java.util.logging.Level; import java.util.logging.LogRecord; @@ -103,7 +104,7 @@ public class HeadersTest { headerMap.put("Accept", Arrays.asList("text/plain")); message.put(Message.PROTOCOL_HEADERS, headerMap); - String loggedString = Headers.toString(message, false); + String loggedString = Headers.toString(headerMap, Set.of("Authorization", "Proxy-Authorization"), false); assertFalse("The value of a sensitive header could be logged: " + loggedString, loggedString.contains("FAIL")); assertTrue("The value of a non-sensitive header would not be logged: " + loggedString, loggedString.contains("application/xml") && loggedString.contains("text/plain")); @@ -120,9 +121,8 @@ public class HeadersTest { headerMap.put("MyCustomHeader", Arrays.asList("Value1")); headerMap.put("NotMyCustomHeader", Arrays.asList("Value2")); message.put(Message.PROTOCOL_HEADERS, headerMap); - message.put("org.apache.http.sensitive.headers", "Authorization,MyCustomHeader"); - String loggedString = Headers.toString(message, false); + String loggedString = Headers.toString(headerMap, Set.of("Authorization", "MyCustomHeader"), false); assertFalse("The value of a custom sensitive header should not be logged: " + loggedString, loggedString.contains("FAIL")); @@ -184,7 +184,8 @@ public class HeadersTest { // no-op } }); - Headers.logProtocolHeaders(logger, Level.INFO, message, false); + Headers.logProtocolHeaders(logger, Level.INFO, headerMap, + Set.of("Authorization", "Proxy-Authorization"), false); } @Test
