From bafa9c47846c60ad7b8e7a942d5380fc2cdffa93 Mon Sep 17 00:00:00 2001 From: Billy Tobon Date: Fri, 23 Jul 2021 15:10:29 -0400 Subject: [PATCH] Sanitize URIs with non-alpha characters in their schemes See gh-27482 --- .../org/springframework/boot/actuate/endpoint/Sanitizer.java | 2 +- .../springframework/boot/actuate/endpoint/SanitizerTests.java | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/Sanitizer.java b/spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/Sanitizer.java index d0c2e73539..d6956b337a 100644 --- a/spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/Sanitizer.java +++ b/spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/Sanitizer.java @@ -50,7 +50,7 @@ public class Sanitizer { private static final Set URI_USERINFO_KEYS = new LinkedHashSet<>( Arrays.asList("uri", "uris", "address", "addresses")); - private static final Pattern URI_USERINFO_PATTERN = Pattern.compile("\\[?[A-Za-z]+://.+:(.*)@.+$"); + private static final Pattern URI_USERINFO_PATTERN = Pattern.compile("^[A-Za-z][A-Za-z0-9\\+\\.\\-]+://.+:(.*)@.+$"); private Pattern[] keysToSanitize; diff --git a/spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/SanitizerTests.java b/spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/SanitizerTests.java index 0a8f0b22cf..4da21fe1d3 100644 --- a/spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/SanitizerTests.java +++ b/spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/SanitizerTests.java @@ -52,8 +52,8 @@ class SanitizerTests { @MethodSource("matchingUriUserInfoKeys") void uriWithSingleValueWithPasswordShouldBeSanitized(String key) { Sanitizer sanitizer = new Sanitizer(); - assertThat(sanitizer.sanitize(key, "http://user:password@localhost:8080")) - .isEqualTo("http://user:******@localhost:8080"); + assertThat(sanitizer.sanitize(key, "view-source://user:password@localhost:8080")) + .isEqualTo("view-source://user:******@localhost:8080"); } @ParameterizedTest(name = "key = {0}")