Redact sensitive duplicate query parameter values in ApiServlet logs

server/src/main/java/com/cloud/api/ApiServer.java

@@ -520,8 +520,9 @@ public void handle(final HttpRequest request, final HttpResponse response, final
                         continue;
                     }
                     if(parameterMap.putIfAbsent(param.getName(), new String[]{param.getValue()}) != null) {
-                        String message = String.format("Query parameter '%s' has multiple values [%s, %s]. Only the last value will be respected." +
-                            "It is advised to pass only a single parameter", param.getName(), param.getValue(), parameterMap.get(param.getName()));
+                        String message = String.format("Query parameter '%s' has multiple values %s. Only the last value will be respected." +
+                            "It is advised to pass only a single parameter", param.getName(),
+                            StringUtils.formatValuesForLog(param.getName(), (String[]) parameterMap.get(param.getName())));
                         logger.warn(StringUtils.cleanString(message));
                     }
                 }

server/src/main/java/com/cloud/api/ApiServlet.java

@@ -78,7 +78,7 @@ public class ApiServlet extends HttpServlet {
     protected static Logger LOGGER = LogManager.getLogger(ApiServlet.class);
     private static final Logger ACCESSLOGGER = LogManager.getLogger("apiserver." + ApiServlet.class.getName());
     private static final String REPLACEMENT = "_";
-    private static final String LOGGER_REPLACEMENTS = "[\n\r\t]";
+private static final String LOGGER_REPLACEMENTS = "[\n\r\t]";
 
     @Inject
     ApiServerService apiServer;
@@ -161,7 +161,7 @@ private void checkSingleQueryParameterValue(Map<String, String[]> params) {
         params.forEach((k, v) -> {
             if (v.length > 1) {
                 String message = String.format("Query parameter '%s' has multiple values %s. Only the last value will be respected." +
-                    "It is advised to pass only a single parameter", k, Arrays.toString(v));
+                    "It is advised to pass only a single parameter", k, StringUtils.formatValuesForLog(k, v));
                 LOGGER.warn(message);
             }
         });

server/src/test/java/com/cloud/api/ApiServletTest.java

@@ -432,4 +432,29 @@ public void testVerify2FAWhenExpectedCommandIsNotCalled() throws UnknownHostExce
 
         Assert.assertEquals(false, result);
     }
+    @Test
+    public void testFormatValuesForLogMasksSensitiveParameters() {
+        String result = ApiServlet.formatValuesForLog(
+            "password",
+            new String[]{"SECRET_ONE", "SECRET_TWO"});
+
+        Assert.assertEquals("[REDACTED, REDACTED]", result);
+    }
+
+    @Test
+    public void testFormatValuesForLogDoesNotMaskNormalParameters() {
+        String result = ApiServlet.formatValuesForLog(
+            "username",
+            new String[]{"alice", "bob"});
+
+        Assert.assertEquals("[alice, bob]", result);
+    }
+
+    @Test
+    public void testIsSensitiveParameter() {
+        Assert.assertTrue(ApiServlet.isSensitiveParameter("adminpassword"));
+        Assert.assertTrue(ApiServlet.isSensitiveParameter("usersecretkey"));
+        Assert.assertTrue(ApiServlet.isSensitiveParameter("sessiontoken"));
+        Assert.assertFalse(ApiServlet.isSensitiveParameter("username"));
+    }
 }

utils/src/main/java/com/cloud/utils/StringUtils.java

@@ -25,9 +25,10 @@
 
 import java.nio.charset.Charset;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
-import java.util.Map;
+import java.util.Locale;
 import java.util.Set;
 import java.util.TreeSet;
 import java.util.regex.Matcher;
@@ -169,6 +170,39 @@ public static String getMaskedPasswordForDisplay(final String password) {
 
     private static final Pattern REGEX_REDUNDANT_AND = Pattern.compile("(&|%26)(&|%26)+");
 
+    private static final String REDACTED = "REDACTED";
+
+    private static final Set<String> SENSITIVE_PARAMETER_KEYWORDS = Set.of(
+            "password",
+            "privatekey",
+            "accesskey",
+            "secretkey",
+            "apikey",
+            "signature",
+            "sessionkey",
+            "token"
+    );
+
+    public static boolean isSensitiveParameter(final String parameterName) {
+        if (parameterName == null) {
+            return false;
+        }
+
+        final String normalized = parameterName.toLowerCase(Locale.ROOT);
+        return SENSITIVE_PARAMETER_KEYWORDS.stream()
+                .anyMatch(normalized::contains);
+    }
+
+    public static String formatValuesForLog(final String parameterName, final String[] values) {
+        if (!isSensitiveParameter(parameterName)) {
+            return Arrays.toString(values);
+        }
+
+        final String[] masked = new String[values.length];
+        Arrays.fill(masked, REDACTED);
+        return Arrays.toString(masked);
+    }
+
     // Responsible for stripping sensitive content from request and response strings
     public static String cleanString(final String stringToClean) {
         String cleanResult = "";