Line data    Source code

       1             : // Copyright (C) 2018 The Android Open Source Project
       2             : //
       3             : // Licensed under the Apache License, Version 2.0 (the "License");
       4             : // you may not use this file except in compliance with the License.
       5             : // You may obtain a copy of the License at
       6             : //
       7             : // http://www.apache.org/licenses/LICENSE-2.0
       8             : //
       9             : // Unless required by applicable law or agreed to in writing, software
      10             : // distributed under the License is distributed on an "AS IS" BASIS,
      11             : // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
      12             : // See the License for the specific language governing permissions and
      13             : // limitations under the License.
      14             : 
      15             : package com.google.gerrit.httpd.restapi;
      16             : 
      17             : import static com.google.gerrit.httpd.restapi.RestApiServlet.XD_AUTHORIZATION;
      18             : 
      19             : import com.google.common.annotations.VisibleForTesting;
      20             : import com.google.common.base.Splitter;
      21             : import com.google.common.collect.ImmutableSet;
      22             : import com.google.gerrit.extensions.restapi.Url;
      23             : import java.util.Iterator;
      24             : 
      25             : public class LogRedactUtil {
      26           4 :   private static final ImmutableSet<String> REDACT_PARAM = ImmutableSet.of(XD_AUTHORIZATION);
      27             : 
      28             :   private LogRedactUtil() {}
      29             : 
      30             :   /**
      31             :    * Redacts sensitive information such as an access token from the query string to make it suitable
      32             :    * for logging.
      33             :    */
      34             :   @VisibleForTesting
      35             :   public static String redactQueryString(String qs) {
      36           4 :     StringBuilder b = new StringBuilder();
      37           4 :     for (String kvPair : Splitter.on('&').split(qs)) {
      38           4 :       Iterator<String> i = Splitter.on('=').limit(2).split(kvPair).iterator();
      39           4 :       String key = i.next();
      40           4 :       if (b.length() > 0) {
      41           1 :         b.append('&');
      42             :       }
      43           4 :       b.append(key);
      44           4 :       if (i.hasNext()) {
      45           4 :         b.append('=');
      46           4 :         if (REDACT_PARAM.contains(Url.decode(key))) {
      47           1 :           b.append('*');
      48             :         } else {
      49           4 :           b.append(i.next());
      50             :         }
      51             :       }
      52           4 :     }
      53           4 :     return b.toString();
      54             :   }
      55             : }