Sonar fix (#2954)

https://sonarcloud.io/project/issues?issueStatuses=OPEN%2CCONFIRMED&types=VULNERABILITY&severities=BLOCKER%2CCRITICAL%2CMAJOR%2CMINOR&inNewCodePeriod=true&sinceLeakPeriod=true&id=cloudfoundry-identity-parent Change this code to not log user-controlled data.
cloudfoundry · Jul 19, 2024 · 0a28b5c · 0a28b5c
1 parent 92044ec
commit 0a28b5c
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 3 deletions.
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/logging/SanitizedLogFactory.java b/server/src/main/java/org/cloudfoundry/identity/uaa/logging/SanitizedLogFactory.java
@@ -55,6 +55,12 @@ public void debug(String message) {
             }
         }
 
+        public void debug(String message, Object... params) {
+            if (fallback.isDebugEnabled()) {
+                fallback.debug(LogSanitizerUtil.sanitize(message), params);
+            }
+        }
+
         public void debug(String message, Throwable t) {
             if (fallback.isDebugEnabled()) {
                 fallback.debug(LogSanitizerUtil.sanitize(message), t);

diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneEndpoints.java b/server/src/main/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneEndpoints.java
@@ -5,6 +5,7 @@
 import org.cloudfoundry.identity.uaa.client.UaaClientDetails;
 import org.cloudfoundry.identity.uaa.constants.OriginKeys;
 import org.cloudfoundry.identity.uaa.error.UaaException;
+import org.cloudfoundry.identity.uaa.logging.SanitizedLogFactory;
 import org.cloudfoundry.identity.uaa.provider.ClientAlreadyExistsException;
 import org.cloudfoundry.identity.uaa.provider.IdentityProvider;
 import org.cloudfoundry.identity.uaa.provider.IdentityProviderProvisioning;
@@ -14,8 +15,6 @@
 import org.cloudfoundry.identity.uaa.scim.ScimGroup;
 import org.cloudfoundry.identity.uaa.scim.ScimGroupProvisioning;
 import org.cloudfoundry.identity.uaa.util.UaaStringUtils;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.context.ApplicationEventPublisherAware;
@@ -64,7 +63,7 @@
 @RequestMapping("/identity-zones")
 public class IdentityZoneEndpoints implements ApplicationEventPublisherAware {
 
-    private static final Logger logger = LoggerFactory.getLogger(IdentityZoneEndpoints.class);
+    private static final SanitizedLogFactory.SanitizedLog logger = SanitizedLogFactory.getLog(IdentityZoneEndpoints.class);
     private static final String ID_SUBDOMAIN_LOGGING = "[{}] subdomain [{}]";
 
     private final IdentityZoneProvisioning zoneDao;

diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/logging/SanitizedLogFactoryTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/logging/SanitizedLogFactoryTest.java
@@ -57,6 +57,8 @@ public void testSanitizeDebug() {
         when(mockLog.isDebugEnabled()).thenReturn(true);
         log.debug(dirtyMessage);
         verify(mockLog).debug(sanitizedMsg);
+        log.debug(dirtyMessage, true);
+        verify(mockLog).debug(sanitizedMsg);
         log.debug(dirtyMessage, ex);
         verify(mockLog).debug(sanitizedMsg, ex);
     }