lxm_library_java/WxJava
1
0
Fork 0
mirror of synced 2026-10-14 19:33:43 +08:00
Code Issues Projects Releases Wiki Activity

🎨 #4055 修复 DataUtils.handleDataWithSecret 在日志输出前对查询串参数 secret 的脱敏缺陷

Browse Source
This commit is contained in:
Vasiliy Mikhailov
2026-07-10 17:30:59 +03:00
committed by GitHub
parent 6ca6c342aa
commit d60cd85578
2 changed files with 30 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
weixin-java-common/src/main/java/me/chanjar/weixin/common/util/DataUtils.java
View File

@@ -17,8 +17,8 @@ public class DataUtils {
*/
public static <E> E handleDataWithSecret(E data) {
E dataForLog = data;
if(data instanceof String && StringUtils.contains((String)data, "&secret=")){
dataForLog = (E) RegExUtils.replaceAll((String)data,"&secret=\\w+&","&secret=******&");
if (data instanceof String && StringUtils.contains((String) data, "secret=")) {
dataForLog = (E) RegExUtils.replaceAll((String) data, "(^|[?&])secret=[^&]*", "$1secret=******");
}
return dataForLog;
}

28
weixin-java-common/src/test/java/me/chanjar/weixin/common/util/DataUtilsTest.java
View File

@@ -19,4 +19,32 @@ public class DataUtilsTest {
final String s = DataUtils.handleDataWithSecret(data);
assertTrue(s.contains("&secret=******&"));
}
@Test
public void testHandleDataWithSecretAtEnd() {
// Secret is the last parameter in the query string, so there is no trailing &
String data = "appid=wx123&secret=abc123";
final String s = DataUtils.handleDataWithSecret(data);
assertFalse(s.contains("abc123"), "Secret at the end of the string should be masked");
assertTrue(s.contains("secret=******"), "Secret should be replaced with asterisks");
}
@Test
public void testHandleDataWithSecretAsFirstParam() {
// Secret is the first parameter, so there is no leading &
String data = "secret=abc123&appid=wx123";
final String s = DataUtils.handleDataWithSecret(data);
assertFalse(s.contains("abc123"), "Secret as the first parameter should be masked");
assertTrue(s.contains("secret=******"), "Secret should be replaced with asterisks");
}
@Test
public void testHandleDataWithSecretEncodedValue() {
// The secret value contains URL-encoded and non-word characters; the whole value must be masked
String data = "appid=wx123&secret=abc%2Fdef-.+ghi&grant_type=client_credential";
final String s = DataUtils.handleDataWithSecret(data);
assertFalse(s.contains("def"), "The full secret value must be masked, including after non-word characters");
assertFalse(s.contains("%2F"), "Encoded characters in the secret must be masked too");
assertTrue(s.contains("&secret=******&"), "Secret should be replaced with asterisks");
}
}