[SCM-1028] Fix clear password logging vulnerability #237
Conversation
|
Fixed issue with @see in JavaDoc of GitUtil.java by recent force push. |
...ons/src/main/java/org/apache/maven/scm/provider/git/repository/GitScmProviderRepository.java
Outdated
Show resolved
Hide resolved
...n-scm-provider-git-commons/src/main/java/org/apache/maven/scm/provider/git/util/GitUtil.java
Outdated
Show resolved
Hide resolved
|
fixed spotless violations |
- GitUtil.java:
- add method maskPasswordInUrl(String urlWithCredentials)
- implementation taken from AnonymousCommandLine.java
- improve regex pattern to be more precise
- replace wrapped with delimiters ':' and '@' to avoid replacing
the password within probable other places of the URL
to avoid password guessing by using e.g. redundant URL parameters
- AnonymousCommandLine.java:
- move current password masking implementation to GitUtil
- use implementation from GitUtil
- GitScmProviderRepository.java:
- add method getFetchUrlWithMaskedPassword()
- add method getPushUrlWithMaskedPassword()
- toString():
- BREAKING change: provide URL content with masked password
to reduce risk of usage within logs or exceptions
with showing passwords by that
- JGitUtils.java:
- method prepareSession(Git git, GitScmProviderRepository repository):
- log using methods:
- GitScmProviderRepository.getFetchUrlWithMaskedPassword()
- GitScmProviderRepository.getPushUrlWithMaskedPassword()
- GitRemoteInfoCommand.java:
- use GitScmProviderRepository.getFetchUrlWithMaskedPassword()
for exception message
- Update JUnit tests accordingly:
- GitScmProviderRepositoryTest.java
- GitCommandLineUtilsTest.java
|
@michael-o Update according to resolved conversations above. |
| public static String maskPasswordInUrl(String urlWithCredentials) { | ||
| String output = urlWithCredentials; | ||
| final Matcher passwordMatcher = PASSWORD_IN_URL_PATTERN.matcher(output); | ||
| if (passwordMatcher.find()) { |
There was a problem hiding this comment.
Why do you use find() and not matches() although your regex goes from start to end?
There was a problem hiding this comment.
That code was taken 1:1 from AnonymousCommandLine.java - did not want to touch this - see comment below.
| if (passwordMatcher.find()) { | ||
| // clear password with delimiters | ||
| final String clearPasswordWithDelimiters = passwordMatcher.group(1); | ||
| // to be replaced in output by stars with delimiters |
There was a problem hiding this comment.
This phrasing is being used at ScmResult.java as well. Did keep this for consistency. Shall we update it everywhere to asterisks then?
There was a problem hiding this comment.
@michael-o Many thanks for your review! Please find my answers accordingly and let me know if / what should be changed or improved.
| public static String maskPasswordInUrl(String urlWithCredentials) { | ||
| String output = urlWithCredentials; | ||
| final Matcher passwordMatcher = PASSWORD_IN_URL_PATTERN.matcher(output); | ||
| if (passwordMatcher.find()) { |
There was a problem hiding this comment.
That code was taken 1:1 from AnonymousCommandLine.java - did not want to touch this - see comment below.
| if (passwordMatcher.find()) { | ||
| // clear password with delimiters | ||
| final String clearPasswordWithDelimiters = passwordMatcher.group(1); | ||
| // to be replaced in output by stars with delimiters |
There was a problem hiding this comment.
This phrasing is being used at ScmResult.java as well. Did keep this for consistency. Shall we update it everywhere to asterisks then?
| /** | ||
| * Provides an anonymous output to mask password. Considering URL of type : | ||
| * <<protocol>>://<<user>>:<<password>>@ | ||
| * <<host_definition>> | ||
| */ | ||
| @Override | ||
| public String toString() { | ||
| String output = super.toString(); | ||
| final Matcher passwordMatcher = passwordPattern.matcher(output); | ||
| if (passwordMatcher.find()) { |
There was a problem hiding this comment.
@michael-o This is the place where the find() did have been taken from - did not want to touch this.
JIRA
SCM-1028 Vulnerability: Clear text password is logged by JGit provider and by gitexe remoteinfo on a ls-remote failure
Changes
GitUtil.java:
AnonymousCommandLine.java:
GitScmProviderRepository.java:
JGitUtils.java:
GitRemoteInfoCommand.java:
Update JUnit tests accordingly:
Test result