Skip to content

Redact sensitive duplicate query parameter values in ApiServlet logs#13559

Open
dheeraj12347 wants to merge 2 commits into
apache:mainfrom
dheeraj12347:fix-redact-sensitive-duplicate-params
Open

Redact sensitive duplicate query parameter values in ApiServlet logs#13559
dheeraj12347 wants to merge 2 commits into
apache:mainfrom
dheeraj12347:fix-redact-sensitive-duplicate-params

Conversation

@dheeraj12347

@dheeraj12347 dheeraj12347 commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

This PR fixes a sensitive information disclosure issue in ApiServlet where duplicate sensitive query parameter values were logged in plaintext before authentication.

Previously, when duplicate query parameters such as password were received, checkSingleQueryParameterValue() logged all values using Arrays.toString(...), which could expose sensitive information in management logs even if the request was later rejected.

Changes

  • Redacted duplicate values for sensitive query parameters before logging.
  • Introduced a shared helper to identify sensitive parameter names.
  • Reused the helper in getCleanParamsString() to avoid duplicating sensitive parameter detection logic.
  • Preserved the existing duplicate-parameter warning behavior for non-sensitive parameters.
  • Added regression tests covering both sensitive and non-sensitive parameter handling.

Testing

  • Verified that duplicate sensitive parameters are logged as [REDACTED, REDACTED].
  • Verified that duplicate non-sensitive parameters continue to be logged unchanged.
  • Added unit tests for sensitive parameter detection.

Fixes #13311

DaanHoogland
DaanHoogland approved these changes Jul 13, 2026
View reviewed changes

@DaanHoogland DaanHoogland left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clgtm

@DaanHoogland

DaanHoogland commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

@dheeraj12347 , do you think this can be applied on older LTS branches (i.e. 4.20)

@dheeraj12347

dheeraj12347 commented Jul 16, 2026

Copy link
Copy Markdown
Contributor Author

@dheeraj12347 , do you think this can be applied on older LTS branches (i.e. 4.20)

From the scope of the change, it looks like a good candidate for backporting since it's localized to ApiServlet and doesn't change request processing behavior. I haven't verified it against the 4.20 branch yet, but I'm happy to check compatibility there and prepare a backport if needed.

@DaanHoogland

DaanHoogland commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

but I'm happy to check compatibility there and prepare a backport if needed.

if you can check please. always good to have these kinds of fixes on all open LTS branches.

@dheeraj12347 dheeraj12347 mentioned this pull request Jul 23, 2026
Open
@dheeraj12347

dheeraj12347 commented Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

but I'm happy to check compatibility there and prepare a backport if needed.

if you can check please. always good to have these kinds of fixes on all open LTS branches.

As requested, I've prepared the manual backport for the 4.20 LTS branch: #13677.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@DaanHoogland DaanHoogland DaanHoogland approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Apache CloudStack ApiServlet logs duplicate sensitive query parameter values in plaintext before authentication

2 participants

@dheeraj12347 @DaanHoogland