[jboss-cvs] Picketbox SVN: r315 - trunk/security-jboss-sx/jbosssx/src/main/java/org/jboss/security/authorization/resources.

[jboss-cvs-commits at lists.jboss.org]

Author: tfonteyn
Date: 2012-03-08 10:43:48 -0500 (Thu, 08 Mar 2012)
New Revision: 315

Modified:
   trunk/security-jboss-sx/jbosssx/src/main/java/org/jboss/security/authorization/resources/WebResource.java
Log:
[SECURITY-650] parameter names are now printed and any j_password parameter is filtered out

Modified: trunk/security-jboss-sx/jbosssx/src/main/java/org/jboss/security/authorization/resources/WebResource.java
===================================================================
--- trunk/security-jboss-sx/jbosssx/src/main/java/org/jboss/security/authorization/resources/WebResource.java	2012-03-08 14:58:46 UTC (rev 314)
+++ trunk/security-jboss-sx/jbosssx/src/main/java/org/jboss/security/authorization/resources/WebResource.java	2012-03-08 15:43:48 UTC (rev 315)
@@ -191,12 +191,20 @@
          for(;enparam.hasMoreElements();)
          {
             String paramName = (String)enparam.nextElement();
-            String[] paramValues = httpRequest.getParameterValues(paramName);
-            int len = paramValues != null ? paramValues.length : 0;
-            for(int i = 0 ; i < len ; i++)
-               sb.append(paramValues[i]).append("::"); 
+            sb.append(paramName).append("=");
+            if (paramName.equalsIgnoreCase("j_password"))
+            {
+               sb.append("***");
+            }
+            else
+            {
+               String[] paramValues = httpRequest.getParameterValues(paramName);
+               int len = paramValues != null ? paramValues.length : 0;
+               for(int i = 0 ; i < len ; i++)
+                  sb.append(paramValues[i]).append("::");
+            }
             sb.append(",");
-         } 
+         }
       } 
       //Append Request attribute information
       if(auditFlag.contains("attributes"))
@@ -213,4 +221,4 @@
       sb.append("]");
       return sb.toString();
    } 
-}
\ No newline at end of file
+}