Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mask secrets in CommandInvokedEvent and Command logger #25307

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

OndroMih
Copy link
Contributor

@OndroMih OndroMih commented Jan 5, 2025

This fixes a security issue in the Command Logger feature, which allowed to expose passwords used in some admin commands. This fix replaces passwords in the logged messages by "******".

subject);
eventService.getCommandInvokedTopic()
.publish(event);
}

private ParameterMap maskSecretParameters(ParameterMap parameters) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could it be static and have unit test?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK. I will add this specific case into the CommandLoggerTest tests.

@@ -1642,12 +1643,22 @@ public void executeFromCheckpoint(JobManager.Checkpoint checkpoint, boolean reve
private void publishCommandInvokedEvent(ExecutionContext invocation, Subject subject) {
final CommandInvokedEvent event = new CommandInvokedEvent(
invocation.name(),
invocation.parameters(),
maskSecretParameters(invocation.parameters()),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The current failures suggest (to me), that invocation.parameters() can be null.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants