Skip to content

Cdbeaver/pro#6976 poc log masking #3780

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
HocKu7 wants to merge 1 commit into
base: devel
Choose a base branch
from
Open

Cdbeaver/pro#6976 poc log masking #3780

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/log/Sensitive.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
package io.cloudbeaver.model.log;

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

/**
* Marks a field or method as sensitive, so its value won't be logged.
*/
@Target(value = {ElementType.METHOD, ElementType.FIELD})
@Retention(RetentionPolicy.RUNTIME)
public @interface Sensitive {
Copy link
Member

@serge-rider serge-rider Sep 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Leta rename it into WebParameterSensitive and put next to WebAction annotation

}
14 changes: 7 additions & 7 deletions server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/graphql/GraphQLEndpoint.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -246,14 +246,14 @@
if (operationName != null) {
contextBuilder.operationName(operationName);
}
String sessionId = GraphQLLoggerUtil.getSmSessionId(request);
// String sessionId = GraphQLLoggerUtil.getSmSessionId(request);

Check warning on line 249 in server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/graphql/GraphQLEndpoint.java

View workflow job for this annotation

GitHub Actions / Server / Lint 

[checkstyle] reported by reviewdog 🐶
Comment has incorrect indentation level 0, expected is 8, indentation should be the same level as line 250.

Raw Output:
/github/workspace/./server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/graphql/GraphQLEndpoint.java:249:1: warning: Comment has incorrect indentation level 0, expected is 8, indentation should be the same level as line 250. (com.puppycrawl.tools.checkstyle.checks.indentation.CommentsIndentationCheck)
String userId = GraphQLLoggerUtil.getUserId(request);
String loggerMessage = GraphQLLoggerUtil.buildLoggerMessage(sessionId, userId, variables);
if (operationName != null) {
log.debug("API > " + operationName + loggerMessage);
} else if (DEBUG) {
log.debug("API > " + query + loggerMessage);
}
// String loggerMessage = GraphQLLoggerUtil.buildLoggerMessage(sessionId, userId, variables);
// if (operationName != null) {
// log.debug("API > " + operationName + loggerMessage);
// } else if (DEBUG) {
// log.debug("API > " + query + loggerMessage);
// }

Check warning on line 256 in server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/graphql/GraphQLEndpoint.java

View workflow job for this annotation

GitHub Actions / Server / Lint 

[checkstyle] reported by reviewdog 🐶
Comment has incorrect indentation level 0, expected is 8, indentation should be the same level as line 257.

Raw Output:
/github/workspace/./server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/graphql/GraphQLEndpoint.java:256:1: warning: Comment has incorrect indentation level 0, expected is 8, indentation should be the same level as line 257. (com.puppycrawl.tools.checkstyle.checks.indentation.CommentsIndentationCheck)
LocalDateTime startTime = LocalDateTime.now();
ExecutionInput executionInput = contextBuilder.build();
ExecutionResult executionResult = null;
Expand Down
67 changes: 45 additions & 22 deletions ...er/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/graphql/GraphQLLoggerUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,14 +16,17 @@
*/
package io.cloudbeaver.server.graphql;

import io.cloudbeaver.model.log.Sensitive;
import io.cloudbeaver.model.session.WebSession;
import io.cloudbeaver.server.WebAppUtils;
import io.cloudbeaver.server.WebApplication;
import jakarta.servlet.http.HttpServletRequest;
import org.jkiss.code.Nullable;
import org.jkiss.utils.CommonUtils;

import java.util.Map;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.lang.reflect.Parameter;
import java.util.Set;

public class GraphQLLoggerUtil {
Expand Down Expand Up @@ -63,43 +66,63 @@
.findWebSession(request);
}

public static String buildLoggerMessage(String sessionId, String userId, Map<String, Object> variables) {
public static String buildLoggerMessage(String sessionId, String userId, Method method, Object[] args) {
StringBuilder loggerMessage = new StringBuilder(" [user: ").append(userId)
.append(", sessionId: ").append(sessionId).append("]");

if (WebAppUtils.getWebPlatform().getPreferenceStore().getBoolean(LOG_API_GRAPHQL_DEBUG_PARAMETER)
&& variables != null
// if (WebAppUtils.getWebPlatform().getPreferenceStore().getBoolean(LOG_API_GRAPHQL_DEBUG_PARAMETER)

Check warning on line 73 in server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/graphql/GraphQLLoggerUtil.java

View workflow job for this annotation

GitHub Actions / Server / Lint 

[checkstyle] reported by reviewdog 🐶
Comment has incorrect indentation level 0, expected is 8, indentation should be the same level as line 74.

Raw Output:
/github/workspace/./server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/server/graphql/GraphQLLoggerUtil.java:73:1: warning: Comment has incorrect indentation level 0, expected is 8, indentation should be the same level as line 74. (com.puppycrawl.tools.checkstyle.checks.indentation.CommentsIndentationCheck)
if (true
) {
loggerMessage.append(" [variables] ");
String parsedVariables = parseVarialbes(variables);
String parsedVariables = maskArgsToString(method, args);
if (CommonUtils.isNotEmpty(parsedVariables)) {
loggerMessage.append(parseVarialbes(variables));
loggerMessage.append(parsedVariables);
}
}
return loggerMessage.toString();
}

private static String parseVarialbes(Map<String, Object> map) {
StringBuilder result = new StringBuilder();
public static String maskArgsToString(Method method, Object[] args) {
StringBuilder sb = new StringBuilder();
Parameter[] params = method.getParameters();

for (Map.Entry<String, Object> entry : map.entrySet()) {
String key = entry.getKey();
Object value = entry.getValue();
for (int i = 0; i < params.length; i++) {
//fixme can't get real parameter names without -parameters compiler option
String name = params[i].getName();
Object value = (args != null && i < args.length) ? args[i] : null;

boolean isProhibited = PROHIBITED_VARIABLES.stream()
.anyMatch(prohibitedKey -> key.toLowerCase().contains(prohibitedKey.toLowerCase()));
sb.append(name).append(": ");

if (isProhibited) {
result.append(key).append(": ").append("******** ");
continue;
}

if (value instanceof Map) {
result.append(parseVarialbes((Map<String, Object>) value));
if (params[i].isAnnotationPresent(Sensitive.class)) {
sb.append("**** ");
} else if (value != null && !isSimple(value.getClass())) {
sb.append("{ ");
for (Field field : value.getClass().getDeclaredFields()) {
field.setAccessible(true);
sb.append(field.getName()).append(": ");
try {
if (field.isAnnotationPresent(Sensitive.class)) {
sb.append("**** ");
} else {
sb.append(field.get(value)).append(" ");
}
} catch (IllegalAccessException e) {
sb.append("<err> ");
}
}
sb.append("} ");
} else {
result.append(key).append(": ").append(value).append(" ");
sb.append(value).append(" ");
}
}
return result.toString().trim();
return sb.toString().trim();
}

private static boolean isSimple(Class<?> cls) {
return cls.isPrimitive()
|| Number.class.isAssignableFrom(cls)
|| CharSequence.class.isAssignableFrom(cls)
|| Boolean.class.equals(cls)
|| Enum.class.isAssignableFrom(cls);
}
}
26 changes: 19 additions & 7 deletions server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/WebServiceBindingBase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,11 @@
import io.cloudbeaver.model.session.WebSessionProvider;
import io.cloudbeaver.server.WebAppUtils;
import io.cloudbeaver.server.graphql.GraphQLEndpoint;
import io.cloudbeaver.server.graphql.GraphQLLoggerUtil;
import io.cloudbeaver.service.security.SMUtils;
import io.cloudbeaver.utils.ServletAppUtils;
import io.cloudbeaver.utils.WebDataSourceUtils;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.jkiss.code.NotNull;
import org.jkiss.code.Nullable;
Expand Down Expand Up @@ -327,16 +329,26 @@
}
}
}
// Perform any checks before action call
protected void beforeWebActionCall(WebAction webAction, Method method, Object[] args) throws DBException {

Check warning on line 333 in server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/WebServiceBindingBase.java

View workflow job for this annotation

GitHub Actions / Server / Lint 

[checkstyle] reported by reviewdog 🐶
'METHOD_DEF' should be separated from previous line.

Raw Output:
/github/workspace/./server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/WebServiceBindingBase.java:333:9: warning: 'METHOD_DEF' should be separated from previous line. (com.puppycrawl.tools.checkstyle.checks.whitespace.EmptyLineSeparatorCheck)

}
HttpServletRequest request = this.env.getGraphQlContext().get("request");
String sessionId = GraphQLLoggerUtil.getSmSessionId(request);
String userId = GraphQLLoggerUtil.getUserId(request);

// Perform any checks before action call
protected void beforeWebActionCall(WebAction webAction, Method method, Object[] args) throws DBException {
setLogContext(method, args);
}
String loggerMessage = GraphQLLoggerUtil.buildLoggerMessage(sessionId, userId, method, args);

if (method.getName() != null) {
log.debug("API > " + method.getName() + loggerMessage);
}

setLogContext(method, args);
}

protected void afterWebActionCall(WebAction webAction, Method method, Object[] args) throws DBException {
Log.setContext(null);
}

protected void afterWebActionCall(WebAction webAction, Method method, Object[] args) throws DBException {
Log.setContext(null);
}

protected void setLogContext(Method method, Object[] args) {
Expand Down
Loading