From 230e9b4601880386178f9f686de133eb109123e3 Mon Sep 17 00:00:00 2001 From: Axel Uhl Date: Tue, 23 Apr 2024 09:57:56 +0200 Subject: [PATCH] erase TracTrac passwords in log output --- .../test/tractrac/PasswordSuppressionTest.java | 14 ++++++++++++++ .../tracking/impl/CourseDesignUpdateHandler.java | 5 +++-- .../tracking/impl/FinishTimeUpdateHandler.java | 2 +- .../domain/tracking/impl/RaceAbortedHandler.java | 5 +++-- .../tracking/impl/StartTimeResetHandler.java | 5 +++-- .../tracking/impl/StartTimeUpdateHandler.java | 7 ++++--- .../domain/tracking/impl/UpdateHandler.java | 4 ++++ 7 files changed, 32 insertions(+), 10 deletions(-) create mode 100644 java/com.sap.sailing.domain.test/src/com/sap/sailing/domain/test/tractrac/PasswordSuppressionTest.java diff --git a/java/com.sap.sailing.domain.test/src/com/sap/sailing/domain/test/tractrac/PasswordSuppressionTest.java b/java/com.sap.sailing.domain.test/src/com/sap/sailing/domain/test/tractrac/PasswordSuppressionTest.java new file mode 100644 index 00000000000..b7053a7bdc4 --- /dev/null +++ b/java/com.sap.sailing.domain.test/src/com/sap/sailing/domain/test/tractrac/PasswordSuppressionTest.java @@ -0,0 +1,14 @@ +package com.sap.sailing.domain.test.tractrac; + +import static org.junit.Assert.assertEquals; + +import org.junit.Test; + +public class PasswordSuppressionTest { + @Test + public void testPasswordSuppression() { + assertEquals("https://em.paris1.tractrac.com/update_race_status?eventid=cbdd7370-daea-013c-d54d-342e996a9920&raceid=a90b8e50-e24a-013c-39f7-0eeb2fba6aa7&username=john.doe%40example.com&password=****&race_status=ABORTED", + "https://em.paris1.tractrac.com/update_race_status?eventid=cbdd7370-daea-013c-d54d-342e996a9920&raceid=a90b8e50-e24a-013c-39f7-0eeb2fba6aa7&username=john.doe%40example.com&password=Humba&race_status=ABORTED" + .replaceAll("password=([^&]*)&", "password=****&")); + } +} diff --git a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/CourseDesignUpdateHandler.java b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/CourseDesignUpdateHandler.java index 50c78d99d3a..197b59187d8 100755 --- a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/CourseDesignUpdateHandler.java +++ b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/CourseDesignUpdateHandler.java @@ -48,7 +48,7 @@ public class CourseDesignUpdateHandler extends UpdateHandler implements CourseDe JSONObject serializedCourseDesign = courseSerializer.serialize(newCourseDesignWithExistingControlPoints); String payload = serializedCourseDesign.toJSONString(); URL currentCourseDesignURL = buildUpdateURL(); - logger.info("Using " + currentCourseDesignURL.toString() + " for the course update!"); + logger.info("Using " + eraseSecurityRelatedValuesFromURL(currentCourseDesignURL.toString()) + " for the course update!"); logger.info("Payload is " + payload); HttpURLConnection connection = (HttpURLConnection) currentCourseDesignURL.openConnection(); try { @@ -62,7 +62,8 @@ public class CourseDesignUpdateHandler extends UpdateHandler implements CourseDe if (connection != null) { connection.disconnect(); } else { - logger.severe("Connection to TracTrac Course Update URL " + currentCourseDesignURL.toString() + " could not be established"); + logger.severe("Connection to TracTrac Course Update URL " + + eraseSecurityRelatedValuesFromURL(currentCourseDesignURL.toString()) + " could not be established"); } } } diff --git a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/FinishTimeUpdateHandler.java b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/FinishTimeUpdateHandler.java index 7ebeb69637d..b6099015f1f 100644 --- a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/FinishTimeUpdateHandler.java +++ b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/FinishTimeUpdateHandler.java @@ -63,7 +63,7 @@ public class FinishTimeUpdateHandler extends UpdateHandler { final CloseableHttpClient client = HttpClientBuilder.create() .setRedirectStrategy(new LaxRedirectStrategyForAllRedirectResponseCodes()) .build(); - logger.info("Using " + stopTrackingURI.toString() + " to stop tracking"); + logger.info("Using " + eraseSecurityRelatedValuesFromURL(stopTrackingURI.toString()) + " to stop tracking"); final HttpResponse response = client.execute(request); try { parseAndLogResponse(new BufferedReader(new InputStreamReader(response.getEntity().getContent(), diff --git a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/RaceAbortedHandler.java b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/RaceAbortedHandler.java index 50b723a4405..9f2bcaf220b 100755 --- a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/RaceAbortedHandler.java +++ b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/RaceAbortedHandler.java @@ -40,7 +40,7 @@ public class RaceAbortedHandler extends UpdateHandler implements RaceAbortedList Map additionalArgs = new HashMap<>(); additionalArgs.put("race_status", raceStatus); URL raceAbortedURL = buildUpdateURL(additionalArgs); - logger.info("Using " + raceAbortedURL.toString() + " for the race aborted notification!"); + logger.info("Using " + eraseSecurityRelatedValuesFromURL(raceAbortedURL.toString()) + " for the race aborted notification!"); HttpURLConnection connection = (HttpURLConnection) raceAbortedURL.openConnection(); try { connection = setConnectionProperties(connection); @@ -53,7 +53,8 @@ public class RaceAbortedHandler extends UpdateHandler implements RaceAbortedList if (connection != null) { connection.disconnect(); } else { - logger.severe("Connection to TracTrac race aborted URL " + raceAbortedURL.toString() + " could not be established"); + logger.severe("Connection to TracTrac race aborted URL " + + eraseSecurityRelatedValuesFromURL(raceAbortedURL.toString()) + " could not be established"); } } } diff --git a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/StartTimeResetHandler.java b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/StartTimeResetHandler.java index 941d74e20ee..68a325c6fe4 100644 --- a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/StartTimeResetHandler.java +++ b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/StartTimeResetHandler.java @@ -29,7 +29,7 @@ public class StartTimeResetHandler extends UpdateHandler implements StartTimeCha return; } URL startTimeUpdateURL = buildUpdateURL(); - logger.info("Using " + startTimeUpdateURL.toString() + " for the start reset!"); + logger.info("Using " + eraseSecurityRelatedValuesFromURL(startTimeUpdateURL.toString()) + " for the start reset!"); HttpURLConnection connection = (HttpURLConnection) startTimeUpdateURL.openConnection(); try { connection = setConnectionProperties(connection); @@ -42,7 +42,8 @@ public class StartTimeResetHandler extends UpdateHandler implements StartTimeCha if (connection != null) { connection.disconnect(); } else { - logger.severe("Connection to TracTrac start time reset URL " + startTimeUpdateURL.toString() + " could not be established"); + logger.severe("Connection to TracTrac start time reset URL " + + eraseSecurityRelatedValuesFromURL(startTimeUpdateURL.toString()) + " could not be established"); } } } diff --git a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/StartTimeUpdateHandler.java b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/StartTimeUpdateHandler.java index db233c01000..fbbca951d2d 100644 --- a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/StartTimeUpdateHandler.java +++ b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/StartTimeUpdateHandler.java @@ -68,7 +68,7 @@ public class StartTimeUpdateHandler extends UpdateHandler implements StartTimeCh additionalParameters.put(FIELD_RACE_START_TIME, String.valueOf(newStartTime.asMillis())); URL startTimeUpdateURL = buildUpdateURL(additionalParameters); - logger.info("Using " + startTimeUpdateURL.toString() + " for the start time update!"); + logger.info("Using " + eraseSecurityRelatedValuesFromURL(startTimeUpdateURL.toString()) + " for the start time update!"); HttpURLConnection connection = (HttpURLConnection) startTimeUpdateURL.openConnection(); try { connection = setConnectionProperties(connection); @@ -81,7 +81,8 @@ public class StartTimeUpdateHandler extends UpdateHandler implements StartTimeCh if (connection != null) { connection.disconnect(); } else { - logger.severe("Connection to TracTrac Course Update URL " + startTimeUpdateURL.toString() + " could not be established"); + logger.severe("Connection to TracTrac Course Update URL " + + eraseSecurityRelatedValuesFromURL(startTimeUpdateURL.toString()) + " could not be established"); } } if (regatta.isControlTrackingFromStartAndFinishTimes()) { @@ -96,7 +97,7 @@ public class StartTimeUpdateHandler extends UpdateHandler implements StartTimeCh final HttpClient client = HttpClientBuilder.create() .setRedirectStrategy(new LaxRedirectStrategyForAllRedirectResponseCodes()) .build(); - logger.info("Using " + startTrackingURI.toString() + " to start tracking"); + logger.info("Using " + eraseSecurityRelatedValuesFromURL(startTrackingURI.toString()) + " to start tracking"); final HttpResponse response = client.execute(request); try { parseAndLogResponse(new BufferedReader(new InputStreamReader(response.getEntity().getContent(), diff --git a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/UpdateHandler.java b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/UpdateHandler.java index 4bf9688e7cc..e66bb304856 100644 --- a/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/UpdateHandler.java +++ b/java/com.sap.sailing.domain/src/com/sap/sailing/domain/tracking/impl/UpdateHandler.java @@ -91,6 +91,10 @@ public class UpdateHandler { return new URI(baseURI.getScheme(), baseURI.getHost(), baseURI.getPath()+(baseURI.getPath().endsWith("/")?"":"/")+action, baseURI.getFragment()); } + protected String eraseSecurityRelatedValuesFromURL(String url) { + return url.replaceAll("password=([^&]*)&", "password=****&"); + } + /** * @return a new list that the caller may extend to add more parameters; the list returned contains the basic * parameters {@code eventid}, {@code raceid}, {@code username} and {@code password}.