Description
DataDesensitizeUtils.desensitizeBody does Map<String,String> bodyMap = JsonUtils.jsonToMap(source, String.class). JsonUtils.jsonToMap catches IOException and returns an empty LinkedHashMap for any non-JSON input. The code then bodyMap.forEach(...) (no-op) and returns JsonUtils.toJson(bodyMap) = "{}" for all non-JSON input. queryParams is request.getURI().getQuery() (e.g. a=1&b=2) — never JSON. requestBody/responseBody are arbitrary content (XML, form-encoded, plain text, HTML).
Location
shenyu-plugin/shenyu-plugin-logging/shenyu-plugin-logging-desensitize-api/src/main/java/org/apache/shenyu/plugin/logging/desensitize/api/utils/DataDesensitizeUtils.java:87-100shenyu-plugin/shenyu-plugin-logging/shenyu-plugin-logging-common/src/main/java/org/apache/shenyu/plugin/logging/common/collector/AbstractLogCollector.java:207-211shenyu-plugin/shenyu-plugin-logging/shenyu-plugin-logging-common/src/main/java/org/apache/shenyu/plugin/logging/common/AbstractLoggingPlugin.java:109
Impact
Whenever desensitization is enabled, legitimate non-JSON request/response bodies and query strings are replaced in the collected log with "{}" — permanent silent data loss in the audit log plus false appearance of empty payloads.
Suggested fix
Only invoke desensitizeBody when source parses as JSON (pre-check or fall back to desensitizeForSingleWord); for queryParams, apply key/value desensitization on the parsed query string rather than treating it as JSON.
Related existing
Distinct from LOG-13 (#6770, KeyWordMatch regex) and #6581 (LogCollectUtils JSON-on-request-thread).
Description
DataDesensitizeUtils.desensitizeBodydoesMap<String,String> bodyMap = JsonUtils.jsonToMap(source, String.class).JsonUtils.jsonToMapcatchesIOExceptionand returns an emptyLinkedHashMapfor any non-JSON input. The code thenbodyMap.forEach(...)(no-op) and returnsJsonUtils.toJson(bodyMap)="{}"for all non-JSON input.queryParamsisrequest.getURI().getQuery()(e.g.a=1&b=2) — never JSON.requestBody/responseBodyare arbitrary content (XML, form-encoded, plain text, HTML).Location
shenyu-plugin/shenyu-plugin-logging/shenyu-plugin-logging-desensitize-api/src/main/java/org/apache/shenyu/plugin/logging/desensitize/api/utils/DataDesensitizeUtils.java:87-100shenyu-plugin/shenyu-plugin-logging/shenyu-plugin-logging-common/src/main/java/org/apache/shenyu/plugin/logging/common/collector/AbstractLogCollector.java:207-211shenyu-plugin/shenyu-plugin-logging/shenyu-plugin-logging-common/src/main/java/org/apache/shenyu/plugin/logging/common/AbstractLoggingPlugin.java:109Impact
Whenever desensitization is enabled, legitimate non-JSON request/response bodies and query strings are replaced in the collected log with
"{}"— permanent silent data loss in the audit log plus false appearance of empty payloads.Suggested fix
Only invoke
desensitizeBodywhensourceparses as JSON (pre-check or fall back todesensitizeForSingleWord); forqueryParams, apply key/value desensitization on the parsed query string rather than treating it as JSON.Related existing
Distinct from LOG-13 (#6770,
KeyWordMatchregex) and #6581 (LogCollectUtilsJSON-on-request-thread).