Mailing-List: contact dev-help@kafka.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@kafka.apache.org
Date: Fri, 17 Feb 2017 17:15:41 +0000 (UTC)
From: "Grant Henke (JIRA)" <jira@apache.org>
To: dev@kafka.apache.org
Message-ID: <JIRA.13041918.1486693493000.111614.1487351741960@Atlassian.JIRA>
In-Reply-To: <JIRA.13041918.1486693493000@Atlassian.JIRA>
References: <JIRA.13041918.1486693493000@Atlassian.JIRA> <JIRA.13041918.1486693493119@jira-lw-us.apache.org>
Subject: [jira] [Commented] (KAFKA-4754) Correctly parse '=' characters in
 command line overrides
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Fri, 17 Feb 2017 17:15:48 -0000


    [ https://issues.apache.org/jira/browse/KAFKA-4754?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15872139#comment-15872139 ] 

Grant Henke commented on KAFKA-4754:
------------------------------------

{quote}
This could expose the password to anyone who is able to run ps on the system, or look at the bash history. So I'm not sure that we should be concerned about the println
{quote}

I think its worth adding, just because 1 thing is wrong and a security hole ,doesn't mean we shouldn't close of fix others. If security were all or nothing we would be left with nothing. Often application logs are passed around aggregated and collected. Access to a machine to run ps or look at the history is a much lower concern than that.

> Correctly parse '=' characters in command line overrides
> --------------------------------------------------------
>
>                 Key: KAFKA-4754
>                 URL: https://issues.apache.org/jira/browse/KAFKA-4754
>             Project: Kafka
>          Issue Type: Bug
>    Affects Versions: 0.9.0.0
>            Reporter: Grant Henke
>            Assignee: Grant Henke
>
> When starting Kafka with an override parameter via "--override my.parameter=myvalue".
> If a value contains an '=' character it fails and exits with "Invalid command line properties:.."
> Often passwords contain an '=' character so its important to support that value. 


--
This message was sent by Atlassian JIRA
(v6.3.15#6346)