[ranger] branch master updated: RANGER-3822: redact password in RangerService.toString()

[ma...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

madhan pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git


The following commit(s) were added to refs/heads/master by this push:
     new 057bba4f5 RANGER-3822: redact password in RangerService.toString()
057bba4f5 is described below

commit 057bba4f570998d1ead6d4c23f7b24a41e7f1e51
Author: Hoo199212 <18...@163.com>
AuthorDate: Tue Jul 12 14:30:17 2022 +0800

    RANGER-3822: redact password in RangerService.toString()
    
    Signed-off-by: Madhan Neethiraj <ma...@apache.org>
---
 .../apache/ranger/plugin/model/RangerService.java  |  9 +++-
 .../ranger/plugin/model/TestRangerService.java     | 48 ++++++++++++++++++++++
 2 files changed, 56 insertions(+), 1 deletion(-)

diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/model/RangerService.java b/agents-common/src/main/java/org/apache/ranger/plugin/model/RangerService.java
index c185962a4..44600b839 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/model/RangerService.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/model/RangerService.java
@@ -27,6 +27,7 @@ import javax.xml.bind.annotation.XmlAccessType;
 import javax.xml.bind.annotation.XmlAccessorType;
 import javax.xml.bind.annotation.XmlRootElement;
 
+import org.apache.commons.lang.StringUtils;
 import org.codehaus.jackson.annotate.JsonAutoDetect;
 import org.codehaus.jackson.annotate.JsonIgnoreProperties;
 import org.codehaus.jackson.annotate.JsonAutoDetect.Visibility;
@@ -41,6 +42,9 @@ import org.codehaus.jackson.map.annotate.JsonSerialize;
 public class RangerService extends RangerBaseModelObject implements java.io.Serializable {
 	private static final long serialVersionUID = 1L;
 
+	public static final String CONFIG_PASSWORD       = "password";
+	public static final String MASKED_PASSWORD_VALUE = "*******";
+
 	private String              type;
 	private String              name;
 	private String              displayName;
@@ -266,7 +270,10 @@ public class RangerService extends RangerBaseModelObject implements java.io.Seri
 		sb.append("configs={");
 		if(configs != null) {
 			for(Map.Entry<String, String> e : configs.entrySet()) {
-				sb.append(e.getKey()).append("={").append(e.getValue()).append("} ");
+				String  key       = e.getKey();
+				boolean maskValue = StringUtils.containsIgnoreCase(key, CONFIG_PASSWORD);
+
+				sb.append(key).append("={").append(maskValue ? MASKED_PASSWORD_VALUE : e.getValue()).append("} ");
 			}
 		}
 		sb.append("} ");
diff --git a/agents-common/src/test/java/org/apache/ranger/plugin/model/TestRangerService.java b/agents-common/src/test/java/org/apache/ranger/plugin/model/TestRangerService.java
new file mode 100644
index 000000000..7ac1c2079
--- /dev/null
+++ b/agents-common/src/test/java/org/apache/ranger/plugin/model/TestRangerService.java
@@ -0,0 +1,48 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.plugin.model;
+
+
+import org.apache.commons.lang.StringUtils;
+import org.junit.Assert;
+import org.junit.Test;
+
+import java.util.HashMap;
+
+
+public class TestRangerService {
+
+    @Test
+    public void test_configToString() {
+        RangerService svc = new RangerService("hdfs", "dev_hdfs", "HDFS", "dev_tag", new HashMap<>());
+        String        str = svc.toString();
+
+        Assert.assertTrue(!StringUtils.containsIgnoreCase(str, RangerService.CONFIG_PASSWORD));
+
+
+        svc.getConfigs().put(RangerService.CONFIG_PASSWORD, "test1234");
+
+        str = svc.toString();
+
+        Assert.assertTrue(StringUtils.containsIgnoreCase(str, RangerService.CONFIG_PASSWORD));
+        Assert.assertTrue(!StringUtils.containsIgnoreCase(str, "test1234"));
+        Assert.assertTrue(StringUtils.containsIgnoreCase(str, RangerService.MASKED_PASSWORD_VALUE));
+    }
+}