glassfish
  1. glassfish
  2. GLASSFISH-18049

Windows username and password printed in clear text to server.log

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Critical Critical
    • Resolution: Fixed
    • Affects Version/s: 3.1.2_dev
    • Fix Version/s: 3.1.2_dev, 4.0
    • Component/s: admin_gui
    • Labels:
      None
    • Environment:

      ogs-3.1.2-b14.zip

      Description

      Currently when DCOM node creation or dcom validation fails, windows username and password are written to server.log in clear text:

      [#|2011-12-19T12:22:05.781-0800|SEVERE|glassfish3.1.2|org.glassfish.admingui|_ThreadID=86;_ThreadName=Thread-2;|RestResponse.getResponse() gives FAILURE. endpoint = 'https://localhost:4848/management/domain/nodes/validate-dcom'; attrs = '

      {windowsuser=j2eetest, host=jed-asqe-43, windowspassword=jabba, remotetestdir=C:\tmp}

      '|#]

      Password should not be printed to server.log in clear text.

        Activity

        Hide
        Anissa Lam added a comment -

        this is logged by admingui not the backend.

        Show
        Anissa Lam added a comment - this is logged by admingui not the backend.
        Hide
        Anissa Lam added a comment - - edited
        • What is the impact on the customer of the bug?
          This is security related. We are exposing user's password in the logfile when user may not be aware.
        • What is the cost/risk of fixing the bug?
          Should be minimum. The value of the password is masked off in a newly created map (containing the key and value) and log this newly created Map. No other executed code should be affect by this change.
        • Is there an impact on documentation or message strings?
          No.
        • Which tests should QA (re)run to verify the fix did not destabilize GlassFish?
          The pages that require password to be entered, purposely cause error and note that the password is masked off when logged in server.log.
          The following page has password entries:
        • create/edit SSH node, DCOM node,
        • setup ssh
        • validate dcom
        • JMS availability Tab
        • Change admin password (Domain -> Admin Password Tab)
        • create and edit Connector Connection Pool Security Map
        • Create and edit File User ( through File Realm user button)
        • create and update Password Alias (Domain -> Pswd Alias tab)
        • Which is the targeted build of 3.1.2 for this fix?
          3.1.2_b16

        The diff is attached.

        Show
        Anissa Lam added a comment - - edited What is the impact on the customer of the bug? This is security related. We are exposing user's password in the logfile when user may not be aware. What is the cost/risk of fixing the bug? Should be minimum. The value of the password is masked off in a newly created map (containing the key and value) and log this newly created Map. No other executed code should be affect by this change. Is there an impact on documentation or message strings? No. Which tests should QA (re)run to verify the fix did not destabilize GlassFish? The pages that require password to be entered, purposely cause error and note that the password is masked off when logged in server.log. The following page has password entries: create/edit SSH node, DCOM node, setup ssh validate dcom JMS availability Tab Change admin password (Domain -> Admin Password Tab) create and edit Connector Connection Pool Security Map Create and edit File User ( through File Realm user button) create and update Password Alias (Domain -> Pswd Alias tab) Which is the targeted build of 3.1.2 for this fix? 3.1.2_b16 The diff is attached.
        Hide
        Anissa Lam added a comment -

        Fix checked into 3.1.2 branch. Available starting from 12/21 nightly build.

        Sending Users/anilam/Awork/V3/3.1.2/3.1.2/admingui/common/src/main/java/org/glassfish/admingui/common/util/RestUtil.java
        Transmitting file data .
        Committed revision 51670.

        Revision: 51670
        Author : anilam
        Date : Dec 20, 2011 8:45:20 AM
        GLASSFISH-18049. Mask off password before logging in logfile.
        Approved: Joe Di Pol

        Show
        Anissa Lam added a comment - Fix checked into 3.1.2 branch. Available starting from 12/21 nightly build. Sending Users/anilam/Awork/V3/3.1.2/3.1.2/admingui/common/src/main/java/org/glassfish/admingui/common/util/RestUtil.java Transmitting file data . Committed revision 51670. Revision: 51670 Author : anilam Date : Dec 20, 2011 8:45:20 AM GLASSFISH-18049 . Mask off password before logging in logfile. Approved: Joe Di Pol
        Hide
        Anissa Lam added a comment -

        Ported the fix to trunk.
        Log Message:
        ------------
        GLASSFISH-18049; Mask off password before logging in logfile.
        This has been checked into 3.1.2. Now port to trunk.
        Revisions:
        ----------
        51838
        Modified Paths:
        ---------------
        trunk/main/appserver/admingui/common/src/main/java/org/glassfish/admingui/common/util/RestUtil.java

        Show
        Anissa Lam added a comment - Ported the fix to trunk. Log Message: ------------ GLASSFISH-18049 ; Mask off password before logging in logfile. This has been checked into 3.1.2. Now port to trunk. Revisions: ---------- 51838 Modified Paths: --------------- trunk/main/appserver/admingui/common/src/main/java/org/glassfish/admingui/common/util/RestUtil.java
        Hide
        lidiam added a comment -

        verified in build ogs-3.1.2-b17.zip

        Show
        lidiam added a comment - verified in build ogs-3.1.2-b17.zip

          People

          • Assignee:
            Anissa Lam
            Reporter:
            lidiam
          • Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved: