Redact sensitive duplicate query parameter values

Author: dheeraj12347

server/src/main/java/com/cloud/api/ApiServer.java

@@ -521,8 +521,9 @@ public void handle(final HttpRequest request, final HttpResponse response, final
                     }
                     if(parameterMap.putIfAbsent(param.getName(), new String[]{param.getValue()}) != null) {
                         String message = String.format("Query parameter '%s' has multiple values %s. Only the last value will be respected." +
-                            "It is advised to pass only a single parameter", param.getName(),
-                            StringUtils.formatValuesForLog(param.getName(), (String[]) parameterMap.get(param.getName())));
+                            " It is advised to pass only a single parameter", param.getName(),
+                            StringUtils.formatValuesForLog(param.getName(),
+                                new String[]{param.getValue(), ((String[]) parameterMap.get(param.getName()))[0]}));
                         logger.warn(StringUtils.cleanString(message));
                     }
                 }

server/src/test/java/com/cloud/api/ApiServletTest.java

@@ -432,29 +432,4 @@ public void testVerify2FAWhenExpectedCommandIsNotCalled() throws UnknownHostExce
 
         Assert.assertEquals(false, result);
     }
-    @Test
-    public void testFormatValuesForLogMasksSensitiveParameters() {
-        String result = ApiServlet.formatValuesForLog(
-            "password",
-            new String[]{"SECRET_ONE", "SECRET_TWO"});
-
-        Assert.assertEquals("[REDACTED, REDACTED]", result);
-    }
-
-    @Test
-    public void testFormatValuesForLogDoesNotMaskNormalParameters() {
-        String result = ApiServlet.formatValuesForLog(
-            "username",
-            new String[]{"alice", "bob"});
-
-        Assert.assertEquals("[alice, bob]", result);
-    }
-
-    @Test
-    public void testIsSensitiveParameter() {
-        Assert.assertTrue(ApiServlet.isSensitiveParameter("adminpassword"));
-        Assert.assertTrue(ApiServlet.isSensitiveParameter("usersecretkey"));
-        Assert.assertTrue(ApiServlet.isSensitiveParameter("sessiontoken"));
-        Assert.assertFalse(ApiServlet.isSensitiveParameter("username"));
-    }
 }

utils/src/main/java/com/cloud/utils/StringUtils.java

@@ -29,6 +29,7 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Locale;
+import java.util.Map;
 import java.util.Set;
 import java.util.TreeSet;
 import java.util.regex.Matcher;

utils/src/test/java/com/cloud/utils/StringUtilsTest.java

@@ -20,6 +20,7 @@
 package com.cloud.utils;
 
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotEquals;
 import static org.junit.Assert.assertTrue;
 
@@ -262,4 +263,30 @@ public void testGetKeyValuePairWithSeparator() {
         assertEquals(key, output.first());
         assertEquals(value, output.second());
     }
+
+    @Test
+    public void testFormatValuesForLogMasksSensitiveParameters() {
+        String result = StringUtils.formatValuesForLog(
+            "password",
+            new String[]{"SECRET_ONE", "SECRET_TWO"});
+
+        assertEquals("[REDACTED, REDACTED]", result);
+    }
+
+    @Test
+    public void testFormatValuesForLogDoesNotMaskNormalParameters() {
+        String result = StringUtils.formatValuesForLog(
+            "username",
+            new String[]{"alice", "bob"});
+
+        assertEquals("[alice, bob]", result);
+    }
+
+    @Test
+    public void testIsSensitiveParameter() {
+        assertTrue(StringUtils.isSensitiveParameter("adminpassword"));
+        assertTrue(StringUtils.isSensitiveParameter("usersecretkey"));
+        assertTrue(StringUtils.isSensitiveParameter("sessiontoken"));
+        assertFalse(StringUtils.isSensitiveParameter("username"));
+    }
 }