[CAMEL-17452] camel-util - URISupport#sanitizeUri sanitizes passwords incorrectly if remaining uri contains expression ${<expr>}

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.14.0
• Fix Version/s: 3.14.1, 3.15.0
• Component/s: camel-core
• Estimated Complexity: Unknown
• Assignee: Unassigned
• Reporter: Claus Skou Nielsen
• Created: 07/Jan/22 14:02
• Updated: 20/Jan/22 06:18
• Resolved: 20/Jan/22 06:18

Description

The following unit test demonstrates the problem with URISupport#sanitize:

    @Test
    public void testSanitizeUriWithRawPasswordAndSimpleExpression() {
        String uriPlain = "http://foo?username=me&password=RAW(me#@123)&foo=bar&port=21&tempFileName=${file:name.noext}.tmp&anotherOption=true";
        String uriCurly = "http://foo?username=me&password=RAW{me#@123}&foo=bar&port=21&tempFileName=${file:name.noext}.tmp&anotherOption=true";
        String expected = "http://foo?username=me&password=xxxxxx&foo=bar&port=21&tempFileName=${file:name.noext}.tmp&anotherOption=true";
        // "http://foo?username=me&password=xxxxxx.tmp&anotherOption=true" is the actual result
        assertEquals(expected, URISupport.sanitizeUri(uriPlain));
        assertEquals(expected, URISupport.sanitizeUri(uriCurly));
    }

The problem is that the SECRETS pattern in URISupport eagerly eats everything up until the ending of ${file:name.noext}.

It can be resolved by changing the regex-pattern, like so:

private static final Pattern SECRETS = Pattern.compile(
            "([?&][^=]*(?:passphrase|password|secretKey|accessToken|clientSecret|authorizationToken|saslJaasConfig)[^=]*)=(RAW(([{][^}]*[}])|([(][^)]*[)]))|[^&]*)",
            Pattern.CASE_INSENSITIVE);

Issue Links

• links to: GitHub Pull Request #6791