fix API Request Parameters Logged Credential Masking in ApiServer

Author: cyl-auth

server/src/main/java/com/cloud/api/ApiServer.java

@@ -39,6 +39,7 @@
 import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
+import java.util.Arrays;
 import java.util.Map;
 import java.util.Set;
 import java.util.TimeZone;
@@ -610,10 +611,27 @@ public String handleRequest(final Map params, final String responseType, final S
                 logger.error("invalid request, no command sent");
                 if (logger.isTraceEnabled()) {
                     logger.trace("dumping request parameters");
-                    for (final  Object key : params.keySet()) {
-                        final String keyStr = (String)key;
-                        final String[] value = (String[])params.get(key);
-                        logger.trace("   key: " + keyStr + ", value: " + ((value == null) ? "'null'" : value[0]));
+                    Set<String> sensitiveFields = new HashSet<>(Arrays.asList(
+                        "password", "secretkey", "apikey", "token",
+                        "sessionkey", "accesskey", "signature",
+                        "authorization", "credential", "secret"
+                    ));
+
+                    for (final Object key : params.keySet()) {
+                        final String keyStr = (String) key;
+                        final String[] value = (String[]) params.get(key);
+
+                        boolean isSensitive = sensitiveFields.stream()
+                            .anyMatch(field -> keyStr.toLowerCase().contains(field));
+
+                        String logValue;
+                        if (isSensitive) {
+                            logValue = "******"; // mask sensitive values
+                        } else {
+                            logValue = (value == null) ? "'null'" : value[0];
+                        }
+
+                        logger.trace("   key: " + keyStr + ", value: " + logValue);
                     }
                 }
                 throw new ServerApiException(ApiErrorCode.UNSUPPORTED_ACTION_ERROR, "Invalid request, no command sent");