package org.apereo.cas.util.serialization;

import lombok.experimental.UtilityClass;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.StringUtils;
import org.apereo.cas.ticket.TicketGrantingTicket;
import org.apereo.cas.ticket.proxy.ProxyGrantingTicket;

import java.util.regex.Matcher;
import java.util.regex.Pattern;

/**
 * This is {@link TicketIdSanitizationUtils} which attempts to remove
 * sensitive ticket ids from a given String.
 *
 * @author Misagh Moayyed
 * @since 5.0.0
 */
@Slf4j
@UtilityClass
public class TicketIdSanitizationUtils {
    private static final Pattern TICKET_ID_PATTERN = Pattern.compile('(' + TicketGrantingTicket.PREFIX + '|'
            + ProxyGrantingTicket.PROXY_GRANTING_TICKET_IOU_PREFIX + '|' + ProxyGrantingTicket.PROXY_GRANTING_TICKET_PREFIX
            + ")(-)+(\\w)+(-)+(\\w)+");

    /**
     * Specifies the ending tail length of the ticket id that would still be visible in the output
     * for troubleshooting purposes.
     */
    private static final int VISIBLE_TAIL_LENGTH = 10;
    
    /**
     * Remove ticket id from the message.
     *
     * @param msg the message
     * @return the modified message with tgt id removed
     */
    public static String sanitize(final String msg) {
        String modifiedMessage = msg;
        if (StringUtils.isNotBlank(msg) && !Boolean.getBoolean("CAS_TICKET_ID_SANITIZE_SKIP")) {
            final Matcher matcher = TICKET_ID_PATTERN.matcher(msg);
            while (matcher.find()) {
                final String match = matcher.group();
                final String newId = matcher.group(1) + '-'
                        + StringUtils.repeat("*", match.length() - VISIBLE_TAIL_LENGTH)
                        + StringUtils.right(match, VISIBLE_TAIL_LENGTH);
                modifiedMessage = modifiedMessage.replaceAll(match, newId);
            }
        }
        return modifiedMessage;
    }
}

@@ -263,16 +263,61 @@
 gTicket;
+%0Aimport org.apereo.cas.util.InetAddressUtils;
 %0A%0Aimport
@@ -678,14 +678,18 @@
 ile(
-'('
+%22(?:(?:%22
  +
- 
 Tick
@@ -714,19 +714,19 @@
 REFIX + 
-'%7C'
+%22%7C%22
 %0A       
@@ -791,11 +791,11 @@
 X + 
-'%7C'
+%22%7C%22
  + P
@@ -862,28 +862,25 @@
 + %22)
-(-)+(%5C%5Cw)+(-)+(%5C%5Cw)+
+-%5C%5Cd+-)(%5B%5C%5Cw.-%5D+)
 %22);%0A
@@ -1087,20 +1087,260 @@
 H = 10;%0A
-    
+%0A    /**%0A     * Gets the default suffix used when the default ticket id generator is used so the poroper%0A     * visible length is shown.%0A     */%0A    private static final int HOST_NAME_LENGTH = InetAddressUtils.getCasServerHostName().length();%0A%0A
 %0A    /**
@@ -1857,20 +1857,25 @@
 nal 
-String newId
+int replaceLength
  = m
@@ -1893,102 +1893,234 @@
 p(1)
- + '-'%0A                        + StringUtils.repeat(%22*%22, match.length() - VISIBLE_TAIL_LENGTH)
+.length()%0A                        - VISIBLE_TAIL_LENGTH%0A                        - (HOST_NAME_LENGTH + 1);%0A                final String newId = match.replace(%0A                        matcher.group(1).substring(0,replaceLength),
 %0A   
@@ -2139,18 +2139,16 @@
         
- +
  StringU
@@ -2157,39 +2157,33 @@
 ls.r
-ight(match, VISIBLE_TAIL_LENGTH
+epeat(%22*%22, replaceLength)
 );%0A 

Fix TGT Masking (#3268)