Move sensitive parameter log helpers to StringUtils

Author: root

server/src/main/java/com/cloud/api/ApiServer.java

@@ -522,7 +522,7 @@ public void handle(final HttpRequest request, final HttpResponse response, final
                     if(parameterMap.putIfAbsent(param.getName(), new String[]{param.getValue()}) != null) {
                         String message = String.format("Query parameter '%s' has multiple values %s. Only the last value will be respected." +
                             "It is advised to pass only a single parameter", param.getName(),
-                            ApiServlet.formatValuesForLog(param.getName(), (String[]) parameterMap.get(param.getName())));
+                            StringUtils.formatValuesForLog(param.getName(), (String[]) parameterMap.get(param.getName())));
                         logger.warn(StringUtils.cleanString(message));
                     }
                 }

server/src/main/java/com/cloud/api/ApiServlet.java

@@ -24,7 +24,6 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Set;
 
 import javax.inject.Inject;
 import javax.servlet.ServletConfig;
@@ -79,20 +78,8 @@ public class ApiServlet extends HttpServlet {
     protected static Logger LOGGER = LogManager.getLogger(ApiServlet.class);
     private static final Logger ACCESSLOGGER = LogManager.getLogger("apiserver." + ApiServlet.class.getName());
     private static final String REPLACEMENT = "_";
-private static final String REDACTED = "REDACTED";
 private static final String LOGGER_REPLACEMENTS = "[\n\r\t]";
 
-private static final Set<String> SENSITIVE_PARAMETER_KEYWORDS = Set.of(
-    "password",
-    "privatekey",
-    "accesskey",
-    "secretkey",
-    "apikey",
-    "signature",
-    "sessionkey",
-    "token"
-);
-
     @Inject
     ApiServerService apiServer;
     @Inject
@@ -174,32 +161,12 @@ private void checkSingleQueryParameterValue(Map<String, String[]> params) {
         params.forEach((k, v) -> {
             if (v.length > 1) {
                 String message = String.format("Query parameter '%s' has multiple values %s. Only the last value will be respected." +
-                    "It is advised to pass only a single parameter", k, formatValuesForLog(k, v));
+                    "It is advised to pass only a single parameter", k, StringUtils.formatValuesForLog(k, v));
                 LOGGER.warn(message);
             }
         });
     }
 
-    static boolean isSensitiveParameter(String parameterName) {
-    if (parameterName == null) {
-        return false;
-    }
-
-    String lowerCaseParameter = parameterName.toLowerCase();
-    return SENSITIVE_PARAMETER_KEYWORDS.stream()
-            .anyMatch(lowerCaseParameter::contains);
-}
-
-static String formatValuesForLog(String parameterName, String[] values) {
-    if (!isSensitiveParameter(parameterName)) {
-        return Arrays.toString(values);
-    }
-
-    String[] masked = new String[values.length];
-    Arrays.fill(masked, REDACTED);
-    return Arrays.toString(masked);
-}
-
     void processRequestInContext(final HttpServletRequest req, final HttpServletResponse resp) {
         InetAddress remoteAddress = null;
         try {

utils/src/main/java/com/cloud/utils/StringUtils.java

@@ -25,9 +25,11 @@
 
 import java.nio.charset.Charset;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
-import java.util.Map;
+import java.util.Locale;
+import java.util.Locale;
 import java.util.Set;
 import java.util.TreeSet;
 import java.util.regex.Matcher;
@@ -169,6 +171,39 @@ public static String getMaskedPasswordForDisplay(final String password) {
 
     private static final Pattern REGEX_REDUNDANT_AND = Pattern.compile("(&|%26)(&|%26)+");
 
+    private static final String REDACTED = "REDACTED";
+
+    private static final Set<String> SENSITIVE_PARAMETER_KEYWORDS = Set.of(
+            "password",
+            "privatekey",
+            "accesskey",
+            "secretkey",
+            "apikey",
+            "signature",
+            "sessionkey",
+            "token"
+    );
+
+    public static boolean isSensitiveParameter(final String parameterName) {
+        if (parameterName == null) {
+            return false;
+        }
+
+        final String normalized = parameterName.toLowerCase(Locale.ROOT);
+        return SENSITIVE_PARAMETER_KEYWORDS.stream()
+                .anyMatch(normalized::contains);
+    }
+
+    public static String formatValuesForLog(final String parameterName, final String[] values) {
+        if (!isSensitiveParameter(parameterName)) {
+            return Arrays.toString(values);
+        }
+
+        final String[] masked = new String[values.length];
+        Arrays.fill(masked, REDACTED);
+        return Arrays.toString(masked);
+    }
+
     // Responsible for stripping sensitive content from request and response strings
     public static String cleanString(final String stringToClean) {
         String cleanResult = "";