[jira] [Commented] (COUCHDB-2952) Teach couch_replicator to use credentials securely

["ASF GitHub Bot (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/COUCHDB-2952?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15649314#comment-15649314 ] 

ASF GitHub Bot commented on COUCHDB-2952:
-----------------------------------------

Github user tonysun83 commented on the issue:

    https://github.com/apache/couchdb-couch-replicator/pull/51
  
    related ticket: https://issues.apache.org/jira/browse/COUCHDB-2952
    I was thinking about adding format_status to each of the gen_servers as well, but I noticed we still leak passwords in LastMsg. These changes won't affect that leak?


> Teach couch_replicator to use credentials securely
> --------------------------------------------------
>
>                 Key: COUCHDB-2952
>                 URL: https://issues.apache.org/jira/browse/COUCHDB-2952
>             Project: CouchDB
>          Issue Type: Bug
>          Components: Replication
>            Reporter: Mike Wallace
>
> The replicator currently stores credentials needed for replication in the gen_server state, either in the source/target URLs or the authorization header. This means it is possible for these credentials to get dumped out to the log file in plain text when couch_replicator terminates.
> The most frequent (as observed so far) case of this was resolved over in COUCHDB-2949 [1] however it is still possible for the gen_server state to end up in the logs (e.g., it can end up in the Reason argument if a message is received that doesn't match any existing callbacks).
> We should therefore store the credentials somewhere other than the state - perhaps an ets table or maybe the process dictionary.
> [1] https://issues.apache.org/jira/browse/COUCHDB-2949 



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)