Mailing-List: contact dev-help@cloudstack.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cloudstack.apache.org
Received-SPF: pass (nike.apache.org: local policy includes SPF record at
 spf.trusted-forwarder.org)
MIME-Version: 1.0
In-Reply-To: 
 <CAGQtxvZGq5Z_Co4Yx770Wt_MBRDSujdsrHjcqpbmmEui=adHDw@mail.gmail.com>
References: <20140408080206.16004.73844@reviews.apache.org>
	<CAJCRRwxbbz=XHkZmV2inzF7jt8=BCp0xy7eAJYejE5Fw78Q=Wg@mail.gmail.com>
	<CAGQtxvZs6A-gXZRpNVT2KamxwQQbevm2A-5nLeRak0M=P-c9Yg@mail.gmail.com>
	<CAJCRRwzVGYnN1E17rh+bPA5DGBVt9OdtMeT=Th=WwFrfBPFNSQ@mail.gmail.com>
	<CAGQtxvZFhG5o-k5H2xc1gvSO8hGv5nS5Y09HTWQBhs-FPJA5GQ@mail.gmail.com>
	<CF716981.43EB7%alena.prokharchyk@citrix.com>
	<CAGQtxvbW_KWNnC=2STr1NKgZHoiU82AFmzNC176i0-BMwUPoxw@mail.gmail.com>
	<CAJCRRwxGyTNdNduS5K_2NOBM-Cq-vdSOKBL=soJrJaxnPju+ow@mail.gmail.com>
	<CAGQtxvZGq5Z_Co4Yx770Wt_MBRDSujdsrHjcqpbmmEui=adHDw@mail.gmail.com>
Date: Tue, 15 Apr 2014 11:55:01 +0530
Message-ID: 
 <CAJCRRwz8hKV7AhbAfMpsxsJoyxS-1-HQwb9LUcWZLKersLEnFw@mail.gmail.com>
Subject: Re: Review Request 20117: Pilot patch for CS JIRA 6213
From: Mandar Barve <mandar.barve@sungardas.com>
To: Daan Hoogland <daan.hoogland@gmail.com>
Cc: Alena Prokharchyk <Alena.Prokharchyk@citrix.com>,
 dev <dev@cloudstack.apache.org>
Content-Type: multipart/alternative; boundary=e89a8f50345e1e6af704f70edc37

--e89a8f50345e1e6af704f70edc37
Content-Type: text/plain; charset=ISO-8859-1

Oh all I meant was stuffing the existing search string that cleanString
uses with all identified "sensitive" keywords. And I guess if it starts
getting GIANT it won't make sense.


On Tue, Apr 15, 2014 at 11:36 AM, Daan Hoogland <daan.hoogland@gmail.com>wrote:

> On Tue, Apr 15, 2014 at 6:01 AM, Mandar Barve
> <mandar.barve@sungardas.com> wrote:
> > 1. The pilot patch I posted already does this of checking the command
> level
> > flag first and only for "flagged" commands check the list of "sensitive"
> > parameters. I was wondering if that code itself, building list of
> sensitive
> > parameters as a command can have more than one of these and then
> stripping
> > them one by one can lead to additional overhead.
> > To reduce that overhead, I was thinking the REGEX that cleanString util
> > function uses can be generated at application load time walking the list
> of
> > all only "sensitive" (flagged) command classes followed by the
> "sensitive"
> > param lists for such classes. At run time when commands are executed all
> you
> > need to do is for the already flagged "sensitive" commands alone use the
> > pre-built REGEX to filter sensitive data.
>
> I am not sure what you mean by this. The REGEX can get quite complex,
> do you envision to create a giant set of or'ed method names? It can be
> done but I doubt that building a REGEX is the best thing at load time.
> At that time more efficient lists or arrays can be build (or a tree
> :P)
> Any way tests will tell us.
>
> --
> Daan
>

--e89a8f50345e1e6af704f70edc37--