Skip to content

Commit 1b1bc7f

Browse files
committed
Switch defaults and model for logging sensitive data
Issue: SPR-17029
1 parent a40d25a commit 1b1bc7f

34 files changed

+241
-229
lines changed

spring-core/src/main/java/org/springframework/core/codec/ByteArrayEncoder.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ public Flux<DataBuffer> encode(Publisher<? extends byte[]> inputStream,
5454

5555
return Flux.from(inputStream).map(bytes -> {
5656
DataBuffer dataBuffer = bufferFactory.wrap(bytes);
57-
if (logger.isDebugEnabled() && !Hints.suppressLogging(hints)) {
57+
if (logger.isDebugEnabled() && !Hints.isLoggingSuppressed(hints)) {
5858
String logPrefix = Hints.getLogPrefix(hints);
5959
logger.debug(logPrefix + "Writing " + dataBuffer.readableByteCount() + " bytes");
6060
}

spring-core/src/main/java/org/springframework/core/codec/ByteBufferEncoder.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ public Flux<DataBuffer> encode(Publisher<? extends ByteBuffer> inputStream,
5555

5656
return Flux.from(inputStream).map(byteBuffer -> {
5757
DataBuffer dataBuffer = bufferFactory.wrap(byteBuffer);
58-
if (logger.isDebugEnabled() && !Hints.suppressLogging(hints)) {
58+
if (logger.isDebugEnabled() && !Hints.isLoggingSuppressed(hints)) {
5959
String logPrefix = Hints.getLogPrefix(hints);
6060
logger.debug(logPrefix + "Writing " + dataBuffer.readableByteCount() + " bytes");
6161
}

spring-core/src/main/java/org/springframework/core/codec/CharSequenceEncoder.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ public Flux<DataBuffer> encode(Publisher<? extends CharSequence> inputStream,
6868
Charset charset = getCharset(mimeType);
6969

7070
return Flux.from(inputStream).map(charSequence -> {
71-
if (logger.isDebugEnabled() && !Hints.suppressLogging(hints)) {
71+
if (logger.isDebugEnabled() && !Hints.isLoggingSuppressed(hints)) {
7272
String logPrefix = Hints.getLogPrefix(hints);
7373
logger.debug(logPrefix + "Writing '" + charSequence + "'");
7474
}

spring-core/src/main/java/org/springframework/core/codec/DataBufferEncoder.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ public Flux<DataBuffer> encode(Publisher<? extends DataBuffer> inputStream,
5454

5555
Flux<DataBuffer> flux = Flux.from(inputStream);
5656

57-
if (logger.isDebugEnabled() && !Hints.suppressLogging(hints)) {
57+
if (logger.isDebugEnabled() && !Hints.isLoggingSuppressed(hints)) {
5858
flux = flux.doOnNext(buffer -> {
5959
String logPrefix = Hints.getLogPrefix(hints);
6060
logger.debug(logPrefix + "Writing " + buffer.readableByteCount() + " bytes");

spring-core/src/main/java/org/springframework/core/codec/Hints.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ public static String getLogPrefix(@Nullable Map<String, Object> hints) {
9999
* @param hints the hints map
100100
* @return whether logging of data is allowed
101101
*/
102-
public static boolean suppressLogging(@Nullable Map<String, Object> hints) {
102+
public static boolean isLoggingSuppressed(@Nullable Map<String, Object> hints) {
103103
return hints != null && (boolean) hints.getOrDefault(SUPPRESS_LOGGING_HINT, false);
104104
}
105105

spring-core/src/main/java/org/springframework/core/codec/ResourceEncoder.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ public boolean canEncode(ResolvableType elementType, @Nullable MimeType mimeType
6868
protected Flux<DataBuffer> encode(Resource resource, DataBufferFactory dataBufferFactory,
6969
ResolvableType type, @Nullable MimeType mimeType, @Nullable Map<String, Object> hints) {
7070

71-
if (logger.isDebugEnabled() && !Hints.suppressLogging(hints)) {
71+
if (logger.isDebugEnabled() && !Hints.isLoggingSuppressed(hints)) {
7272
String logPrefix = Hints.getLogPrefix(hints);
7373
logger.debug(logPrefix + "Writing [" + resource + "]");
7474
}

spring-core/src/main/java/org/springframework/core/codec/ResourceRegionEncoder.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ private Flux<DataBuffer> writeResourceRegion(
122122
long position = region.getPosition();
123123
long count = region.getCount();
124124

125-
if (logger.isDebugEnabled() && !Hints.suppressLogging(hints)) {
125+
if (logger.isDebugEnabled() && !Hints.isLoggingSuppressed(hints)) {
126126
logger.debug(Hints.getLogPrefix(hints) +
127127
"Writing region " + position + "-" + (position + count) + " of [" + resource + "]");
128128
}

spring-web/src/main/java/org/springframework/http/codec/CodecConfigurer.java

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -111,19 +111,13 @@ interface DefaultCodecs {
111111
void jackson2JsonEncoder(Encoder<?> encoder);
112112

113113
/**
114-
* Whether to disable logging of request details for form and multipart
115-
* requests at any log level. By default such data is logged under
116-
* {@code "org.springframework.http.codec"} but may contain sensitive
117-
* information. Typically that's not an issue since DEBUG is used in
118-
* development, but this option may be used to explicitly disable any
119-
* logging of form and multipart data at any log level.
120-
* <p>By default this is set to {@code false} in which case form and
121-
* multipart data is logged at DEBUG or TRACE. When set to {@code true}
122-
* values will not be logged at any level.
123-
* @param disableLoggingRequestDetails whether to disable loggins
114+
* Whether to log form data at DEBUG level, and headers at TRACE level.
115+
* Both may contain sensitive information.
116+
* <p>By default set to {@code false} so that request details are not shown.
117+
* @param enable whether to enable or not
124118
* @since 5.1
125119
*/
126-
void disableLoggingRequestDetails(boolean disableLoggingRequestDetails);
120+
void enableLoggingRequestDetails(boolean enable);
127121
}
128122

129123

spring-web/src/main/java/org/springframework/http/codec/FormHttpMessageReader.java

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -108,8 +108,10 @@ public Mono<MultiValueMap<String, String>> readMono(ResolvableType elementType,
108108
String body = charBuffer.toString();
109109
DataBufferUtils.release(buffer);
110110
MultiValueMap<String, String> formData = parseFormData(charset, body);
111-
if (shouldLogRequestDetails()) {
112-
logger.debug(Hints.getLogPrefix(hints) + "Decoded " + formData);
111+
if (logger.isDebugEnabled()) {
112+
String details = isEnableLoggingRequestDetails() ?
113+
formData.toString() : "form fields " + formData.keySet() + " (content masked)";
114+
logger.debug(Hints.getLogPrefix(hints) + "Read " + details);
113115
}
114116
return formData;
115117
});

spring-web/src/main/java/org/springframework/http/codec/FormHttpMessageWriter.java

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -131,8 +131,10 @@ public Mono<Void> write(Publisher<? extends MultiValueMap<String, String>> input
131131
Assert.notNull(charset, "No charset"); // should never occur
132132

133133
return Mono.from(inputStream).flatMap(form -> {
134-
if (shouldLogRequestDetails()) {
135-
logger.debug(Hints.getLogPrefix(hints) + "Encoding " + form);
134+
if (logger.isDebugEnabled()) {
135+
String details = isEnableLoggingRequestDetails() ?
136+
form.toString() : "form fields " + form.keySet() + " (content masked)";
137+
logger.debug(Hints.getLogPrefix(hints) + "Writing " + details);
136138
}
137139
String value = serializeForm(form, charset);
138140
ByteBuffer byteBuffer = charset.encode(value);

0 commit comments

Comments
 (0)