[jira] [Created] (ZOOKEEPER-3504) An information leakage from FileTxnSnapLog to log:

["xiaoqin.fu (JIRA)" <ji...@apache.org>]

xiaoqin.fu created ZOOKEEPER-3504:
-------------------------------------

             Summary: An information leakage from FileTxnSnapLog to log:
                 Key: ZOOKEEPER-3504
                 URL: https://issues.apache.org/jira/browse/ZOOKEEPER-3504
             Project: ZooKeeper
          Issue Type: Bug
          Components: security, server
    Affects Versions: 3.4.14, 3.5.5, 3.4.13, 3.4.12, 3.4.11
            Reporter: xiaoqin.fu


In org.apache.zookeeper.server.persistence.FileTxnSnapLog, the statement LOG.debug don't have LOG controls:
    public void processTransaction(TxnHeader hdr,DataTree dt,
            Map<Long, Integer> sessions, Record txn)
        throws KeeperException.NoNodeException {  
		......
        if (rc.err != Code.OK.intValue()) {
            LOG.debug("Ignoring processTxn failure hdr:" + hdr.getType()
                    + ", error: " + rc.err + ", path: " + rc.path);
        }  
		......
    } 

Sensitive information about hdr type or rc path was leaked. The conditional statement LOG.isDebugEnabled() should be added:
    public void processTransaction(TxnHeader hdr,DataTree dt,
            Map<Long, Integer> sessions, Record txn)
        throws KeeperException.NoNodeException {  
		......
        if (rc.err != Code.OK.intValue()) {
        	if (LOG.isDebugEnabled())
				LOG.debug("Ignoring processTxn failure hdr:" + hdr.getType()
                    + ", error: " + rc.err + ", path: " + rc.path);
        }  
		......
    } 



--
This message was sent by Atlassian JIRA
(v7.6.14#76016)