You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@karaf.apache.org by "Jean-Baptiste Onofré (Jira)" <ji...@apache.org> on 2022/07/04 05:02:00 UTC
[jira] [Updated] (KARAF-7256) Action logs could leak passwords if passed as argument or option
[ https://issues.apache.org/jira/browse/KARAF-7256?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jean-Baptiste Onofré updated KARAF-7256:
----------------------------------------
Target Version/s: 4.3.8, 4.4.2 (was: 4.4.1, 4.3.8)
> Action logs could leak passwords if passed as argument or option
> ----------------------------------------------------------------
>
> Key: KARAF-7256
> URL: https://issues.apache.org/jira/browse/KARAF-7256
> Project: Karaf
> Issue Type: Bug
> Components: karaf
> Affects Versions: 4.3.2
> Reporter: J. Brébec
> Assignee: Jean-Baptiste Onofré
> Priority: Major
>
> If a shell Action take a sensible argument like a password, this password will be visible every time the Action log something.
> The statement is used to set the name of the thread, without obfuscating any arguments or options. The thread name is logged with the default log4j configuration.
> [felix-dev/Pipe.java at 3e5671ae7e5107f4f849ef9d5f0a89b1ba9d7439 · apache/felix-dev · GitHub|https://github.com/apache/felix-dev/blob/3e5671ae7e5107f4f849ef9d5f0a89b1ba9d7439/gogo/runtime/src/main/java/org/apache/felix/gogo/runtime/Pipe.java#L228]
>
> Using the "censor" property in @Argument or @Option doesn't change anything.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)