From 4749613947b89627685694a27309b78816dd09f6 Mon Sep 17 00:00:00 2001
From: Rinjae <dearmai@dearmai.net>
Date: Wed, 29 Jul 2026 20:20:43 +0900
Subject: [PATCH] =?UTF-8?q?-=20PortalOrg=20=EC=B4=88=EA=B8=B0=ED=99=94=20?=
 =?UTF-8?q?=ED=95=84=EB=93=9C=20=EC=B6=94=EA=B0=80(orgDesc,=20ipWhitelist?=
 =?UTF-8?q?=20=EB=93=B1)=20-=20ApiTesterFilter=20=EB=94=94=EB=B2=84?=
 =?UTF-8?q?=EA=B9=85=20=EB=A1=9C=EC=A7=81/=EC=9C=A0=ED=8B=B8=20=EC=B6=94?=
 =?UTF-8?q?=EA=B0=80(maskHeaders=20=EB=93=B1)=20-=20jackson-core=20?=
 =?UTF-8?q?=EC=B7=A8=EC=95=BD=EC=A0=90(CVSS=207.5)=20=EC=88=98=EC=A0=95=20?=
 =?UTF-8?q?=EB=B2=84=EC=A0=84=20=EC=97=85=EA=B7=B8=EB=A0=88=EC=9D=B4?=
 =?UTF-8?q?=EB=93=9C(2.18.6)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 build.gradle                                  |  7 ++--
 .../apps/apis/filter/ApiTesterFilter.java     | 34 +++++++++++++++++++
 2 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/build.gradle b/build.gradle
index 90b7ea6..e0ffd74 100644
--- a/build.gradle
+++ b/build.gradle
@@ -80,9 +80,10 @@ dependencies {
 //        exclude group: 'commons-collections', module: 'commons-collections'
     }
     implementation 'org.mapstruct:mapstruct:1.5.5.Final'
-    implementation 'com.fasterxml.jackson.core:jackson-core:2.15.3'
-    implementation 'com.fasterxml.jackson.core:jackson-annotations:2.15.3'
-    implementation 'com.fasterxml.jackson.core:jackson-databind:2.15.3'
+    // WS-2026-0003 (jackson-core async parser DoS, CVSS 7.5) — 2.18.6 에서 수정. JDK8 호환.
+    implementation 'com.fasterxml.jackson.core:jackson-core:2.18.6'
+    implementation 'com.fasterxml.jackson.core:jackson-annotations:2.18.6'
+    implementation 'com.fasterxml.jackson.core:jackson-databind:2.18.6'
 
     implementation group: 'org.apache.velocity', name: 'velocity-engine-core', version: '2.3'
 
diff --git a/src/main/java/com/eactive/apim/portal/apps/apis/filter/ApiTesterFilter.java b/src/main/java/com/eactive/apim/portal/apps/apis/filter/ApiTesterFilter.java
index 6899963..c7dfd23 100644
--- a/src/main/java/com/eactive/apim/portal/apps/apis/filter/ApiTesterFilter.java
+++ b/src/main/java/com/eactive/apim/portal/apps/apis/filter/ApiTesterFilter.java
@@ -203,6 +203,14 @@ public class ApiTesterFilter implements Filter {
             }
 
             proxyTarget = targetUri;
+            if (logger.isDebugEnabled()) {
+                // GW SERVICE_NOT_FOUND(어댑터 URI 미등록)·AUTH_FAIL 진단용:
+                // 스펙 식별/응답유형, 실제 forward 대상, 전달 헤더(민감값 마스킹), 본문 길이를 남긴다.
+                logger.debug("{} forward - auditId={}, apiId={}, apiUrl={}, apiMethod={}, responseType={}, originalUrl={}, target={}, bodyLen={}, headers={}",
+                        auditType, auditId, apiSpecInfoDto.getApiId(), apiSpecInfoDto.getApiUrl(),
+                        apiSpecInfoDto.getApiMethod(), responseType, url, targetUri,
+                        requestBody == null ? 0 : requestBody.length(), maskHeaders(headers));
+            }
             APISender apiSender = ApplicationContextUtil.getContext().getBean(APISender.class);
             String responseStr;
             if ("post".equalsIgnoreCase(apiSpecInfoDto.getApiMethod())) {
@@ -210,6 +218,11 @@ public class ApiTesterFilter implements Filter {
             } else {
                 responseStr = apiSender.requestGet(targetUri, headers, paramMap);
             }
+            if (logger.isDebugEnabled()) {
+                logger.debug("{} response - auditId={}, target={}, respLen={}, preview={}",
+                        auditType, auditId, targetUri,
+                        responseStr == null ? 0 : responseStr.length(), previewOf(responseStr));
+            }
             response.setContentType("application/json");
             response.getWriter().println(responseStr);
         }
@@ -308,6 +321,27 @@ public class ApiTesterFilter implements Filter {
     }
 
     /** 상태코드 + JSON 본문 응답. */
+    /** forward 헤더 debug 출력용 — 민감 헤더(토큰/쿠키 등)는 StringMaskingUtil 로 마스킹. */
+    private String maskHeaders(Map<String, String> headers) {
+        StringBuilder sb = new StringBuilder("{");
+        for (Map.Entry<String, String> e : headers.entrySet()) {
+            if (sb.length() > 1) {
+                sb.append(", ");
+            }
+            sb.append(e.getKey()).append(':').append(StringMaskingUtil.maskHeaderValue(e.getKey(), e.getValue()));
+        }
+        return sb.append('}').toString();
+    }
+
+    /** 응답 body debug 프리뷰 — 앞 300자까지만 (개행 제거). */
+    private String previewOf(String body) {
+        if (body == null) {
+            return "null";
+        }
+        String flat = body.replaceAll("\\s+", " ").trim();
+        return flat.length() > 300 ? flat.substring(0, 300) + "…" : flat;
+    }
+
     private void writeJson(ServletResponse response, int status, String json) throws IOException {
         ((HttpServletResponse) response).setStatus(status);
         response.setContentType("application/json");