ruanweihong-aaa commented on code in PR #14040:
URL: https://github.com/apache/apisix/pull/14040#discussion_r4333008376
##########
apisix/init.lua:
##########
@@ -1038,6 +1042,15 @@ function _M.http_access_phase()
end
span:finish(ngx_ctx)
+ if api_ctx.servlet_upstream_uri then
+ if api_ctx.var.upstream_uri == api_ctx.servlet_upstream_uri or
+ not api_ctx.var.upstream_uri or api_ctx.var.upstream_uri == "" then
+ api_ctx.var.upstream_uri = api_ctx.servlet_upstream_uri
+ .. (api_ctx.var.is_args or "")
+ .. (api_ctx.var.args or "")
Review Comment:
Thanks for the update. I compared base `e14c6e93` with head `c1fd74f6`:
query preservation and `hide_credentials` work as expected, but appending the
query here introduces a data-mask interaction.
With `normalize_uri_like_servlet` enabled, configure data-mask to remove the
`password` query parameter and log `$request_line` together with
`$upstream_uri`. For `/anything;jsessionid=x?password=secret`, I get:
```text
base: request_line="GET /anything HTTP/1.1"
upstream_uri="/anything;jsessionid=x"
head: request_line="GET /anything HTTP/1.1"
upstream_uri="/anything;jsessionid=x?password=secret"
```
data-mask does not sanitize `$upstream_uri` during its log phase, so the
password remains in the log even when `$request` has been replaced with the
masked `$request_line`. This is separate from the existing raw `$request`
behavior.
Could you handle this field during log masking and add a regression test for
this combination?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
