From d60cd85578a8bc766fba4d6a47503b74664eee2f Mon Sep 17 00:00:00 2001 From: Vasiliy Mikhailov Date: Fri, 10 Jul 2026 17:30:59 +0300 Subject: [PATCH] =?UTF-8?q?:art:=20#4055=20=E4=BF=AE=E5=A4=8D=20DataUtils.?= =?UTF-8?q?handleDataWithSecret=20=E5=9C=A8=E6=97=A5=E5=BF=97=E8=BE=93?= =?UTF-8?q?=E5=87=BA=E5=89=8D=E5=AF=B9=E6=9F=A5=E8=AF=A2=E4=B8=B2=E5=8F=82?= =?UTF-8?q?=E6=95=B0=20secret=20=E7=9A=84=E8=84=B1=E6=95=8F=E7=BC=BA?= =?UTF-8?q?=E9=99=B7?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../chanjar/weixin/common/util/DataUtils.java | 4 +-- .../weixin/common/util/DataUtilsTest.java | 28 +++++++++++++++++++ 2 files changed, 30 insertions(+), 2 deletions(-) diff --git a/weixin-java-common/src/main/java/me/chanjar/weixin/common/util/DataUtils.java b/weixin-java-common/src/main/java/me/chanjar/weixin/common/util/DataUtils.java index b8fb42e0e..095363cf8 100644 --- a/weixin-java-common/src/main/java/me/chanjar/weixin/common/util/DataUtils.java +++ b/weixin-java-common/src/main/java/me/chanjar/weixin/common/util/DataUtils.java @@ -17,8 +17,8 @@ public class DataUtils { */ public static E handleDataWithSecret(E data) { E dataForLog = data; - if(data instanceof String && StringUtils.contains((String)data, "&secret=")){ - dataForLog = (E) RegExUtils.replaceAll((String)data,"&secret=\\w+&","&secret=******&"); + if (data instanceof String && StringUtils.contains((String) data, "secret=")) { + dataForLog = (E) RegExUtils.replaceAll((String) data, "(^|[?&])secret=[^&]*", "$1secret=******"); } return dataForLog; } diff --git a/weixin-java-common/src/test/java/me/chanjar/weixin/common/util/DataUtilsTest.java b/weixin-java-common/src/test/java/me/chanjar/weixin/common/util/DataUtilsTest.java index f5732d9a0..1bda61a23 100644 --- a/weixin-java-common/src/test/java/me/chanjar/weixin/common/util/DataUtilsTest.java +++ b/weixin-java-common/src/test/java/me/chanjar/weixin/common/util/DataUtilsTest.java @@ -19,4 +19,32 @@ public class DataUtilsTest { final String s = DataUtils.handleDataWithSecret(data); assertTrue(s.contains("&secret=******&")); } + + @Test + public void testHandleDataWithSecretAtEnd() { + // Secret is the last parameter in the query string, so there is no trailing & + String data = "appid=wx123&secret=abc123"; + final String s = DataUtils.handleDataWithSecret(data); + assertFalse(s.contains("abc123"), "Secret at the end of the string should be masked"); + assertTrue(s.contains("secret=******"), "Secret should be replaced with asterisks"); + } + + @Test + public void testHandleDataWithSecretAsFirstParam() { + // Secret is the first parameter, so there is no leading & + String data = "secret=abc123&appid=wx123"; + final String s = DataUtils.handleDataWithSecret(data); + assertFalse(s.contains("abc123"), "Secret as the first parameter should be masked"); + assertTrue(s.contains("secret=******"), "Secret should be replaced with asterisks"); + } + + @Test + public void testHandleDataWithSecretEncodedValue() { + // The secret value contains URL-encoded and non-word characters; the whole value must be masked + String data = "appid=wx123&secret=abc%2Fdef-.+ghi&grant_type=client_credential"; + final String s = DataUtils.handleDataWithSecret(data); + assertFalse(s.contains("def"), "The full secret value must be masked, including after non-word characters"); + assertFalse(s.contains("%2F"), "Encoded characters in the secret must be masked too"); + assertTrue(s.contains("&secret=******&"), "Secret should be replaced with asterisks"); + } }