(sling-org-apache-sling-servlets-post) branch master updated: fix(security): sanitize redirect target in log messages to prevent log injection (#41)

[cziegeler]

This is an automated email from the ASF dual-hosted git repository.

cziegeler pushed a commit to branch master
in repository 
https://gitbox.apache.org/repos/asf/sling-org-apache-sling-servlets-post.git


The following commit(s) were added to refs/heads/master by this push:
     new 432f0ed  fix(security): sanitize redirect target in log messages to 
prevent log injection (#41)
432f0ed is described below

commit 432f0edbcbd5ae7c6b32140d38ebfd80d435e5c4
Author: Carsten Ziegeler <cziege...@apache.org>
AuthorDate: Thu Jul 16 17:50:59 2026 +0200

    fix(security): sanitize redirect target in log messages to prevent log 
injection (#41)
    
    * fix(security): sanitize redirect target in log messages to prevent log 
injection
    
    Co-authored-by: Maia <maia@noreply>
    
    * fix(security): avoid eager redirect log sanitization
    
    ---------
    
    Co-authored-by: Maia <maia@noreply>
---
 .../sling/servlets/post/impl/SlingPostServlet.java | 26 ++++++++++++++++------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git 
a/src/main/java/org/apache/sling/servlets/post/impl/SlingPostServlet.java 
b/src/main/java/org/apache/sling/servlets/post/impl/SlingPostServlet.java
index fac783c..2c847d2 100644
--- a/src/main/java/org/apache/sling/servlets/post/impl/SlingPostServlet.java
+++ b/src/main/java/org/apache/sling/servlets/post/impl/SlingPostServlet.java
@@ -375,6 +375,10 @@ public class SlingPostServlet extends 
SlingJakartaAllMethodsServlet {
 
     private static final Pattern REDIRECT_WITH_SCHEME_PATTERN = 
Pattern.compile("^(https?://[^/]+)(.*)$");
 
+    private static String sanitizeForLog(final String value) {
+        return value == null ? null : value.replace('\r', '_').replace('\n', 
'_');
+    }
+
     /**
      * Creates an instance of a PostResponse.
      * @param req The request being serviced
@@ -463,22 +467,30 @@ public class SlingPostServlet extends 
SlingJakartaAllMethodsServlet {
                 URI redirectUri = new URI(encodedURL);
                 if (redirectUri.getAuthority() != null) {
                     // if it has a host information
-                    log.warn(
-                            "redirect target ({}) does include host 
information ({}). This is not allowed for security reasons!",
-                            result,
-                            redirectUri.getAuthority());
+                    if (log.isWarnEnabled()) {
+                        log.warn(
+                                "redirect target ({}) does include host 
information ({}). This is not allowed for security reasons!",
+                                sanitizeForLog(result),
+                                sanitizeForLog(redirectUri.getAuthority()));
+                    }
                     return null;
                 }
             } catch (URISyntaxException e) {
-                log.warn("given redirect target ({}) is not a valid uri: {}", 
result, e);
+                if (log.isWarnEnabled()) {
+                    log.warn("given redirect target ({}) is not a valid uri: 
{}", sanitizeForLog(result), e);
+                }
                 return null;
             }
 
-            log.debug("redirect requested as [{}] for path [{}]", result, 
ctx.getPath());
+            if (log.isDebugEnabled()) {
+                log.debug("redirect requested as [{}] for path [{}]", 
sanitizeForLog(result), ctx.getPath());
+            }
 
             result = handleStarResource(result, ctx, request);
 
-            log.debug("Will redirect to {}", result);
+            if (log.isDebugEnabled()) {
+                log.debug("Will redirect to {}", sanitizeForLog(result));
+            }
         }
         return encodeRedirectUrl(result, response, request);
     }