Andrea Cosentino created CAMEL-24973:
----------------------------------------
Summary: camel-util - URISupport.sanitizeUri does not follow the
endpoint URI parser for RAW values, userinfo, dash-case option names and
additional keywords
Key: CAMEL-24973
URL: https://issues.apache.org/jira/browse/CAMEL-24973
Project: Camel
Issue Type: Bug
Components: camel-core
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.23.0
URISupport.sanitizeUri() masks option values with regular expressions that do
not always match how Camel parses and binds endpoint URIs, so some values are
only partly masked or not masked:
* RAW values: the sanitizer ends RAW(...) and RAW\{...\} at the first closing
bracket, while URIScanner ends them at a closing bracket followed by & or the
end of the string (see URISupportTest#testParseQuery).
EndpointUriFactorySupport and YamlSupport wrap secret options in RAW()
automatically.
* Userinfo: USERINFO_PASSWORD is not limited to the authority component, so
when a later part of the string contains another :// and @ the wrong segment is
replaced.
* Option names: names are matched literally against the sensitive keywords, but
property binding also accepts dash-case names
(PropertyBindingSupport.undashKey) and SensitiveUtils.containsSensitive()
ignores '-' (CAMEL-16146). Dash-case forms such as connection-string,
private-key, shared-access-key or sasl-jaas-config are not masked.
* addSanitizeKeywords() (CAMEL-22365): the extra pattern is applied with
replaceFirst, each call replaces the previously added keywords although the
javadoc says they are added, and a call with only built-in keywords compiles an
empty alternation.
Related: DefaultComponent.validateParameters(), ScheduledPollConsumer and
JettyHttpComponent12 list unknown parameters with their values ("Unknown
parameters=\[...\]") without applying the same masking.
Proposed change: align RAW termination with URIScanner, scope the userinfo
match to the authority, normalize option names before keyword matching, apply
additional keywords to every match and accumulate them, mask sensitive values
in the unknown-parameters message, and add URISupportTest coverage for each
case.
_Claude Code on behalf of oscerd_
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
