[CXF-8985] headers masking implementation not replaceable

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.5.7
• Component/s: logging

Environment

OpenJDK 1.8.0_382

CentOS 7

Tomcat 8.5.57

Spring 4.3.30.RELEASE

• Estimated Complexity: Unknown

Language

Java

• Assignee: Unassigned
• Reporter: Erich Mauerböck
• Created: 08/Mar/24 09:09
• Updated: 08/Mar/24 09:15

Description

Recently I tried to switch away from the deprecated org.apache.cxf.interceptor Logging interceptors to the separate cxf-rt-features-logging module, realizing that I could also switch to the org.apache.cxf.ext.logging.LoggingFeature eliminating the need for explicitly configuring interceptors as described in https://cxf.apache.org/docs/message-logging.html

I also wanted to replace my proprietary sensitive masking implementation by a customized intended org.apache.cxf.ext.logging.MaskSensitiveHelper.

 

But I noticed that this only worked for sensitive elements, not for sensitive protocol header names, as MaskSensitiveHelper.maskHeaders() never gets called. Instead, headers masking is done by org.apache.cxf.ext.logging.event.DefaultLogEventMapper, which is final in org.apache.cxf.ext.logging.AbstractLoggingInterceptor, therefore cannot be changed. In turn, MaskSensitiveHelper in DefaultLogEventMapper is also not changeable (no setter).

This behaviour cannot have been intended that way.