zookeeper-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Patrick Hunt (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (ZOOKEEPER-3489) Possible information leakage to log without LOG configuration control LOG.isWarnEnabled()
Date Tue, 06 Aug 2019 03:20:00 GMT

    [ https://issues.apache.org/jira/browse/ZOOKEEPER-3489?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16900569#comment-16900569
] 

Patrick Hunt commented on ZOOKEEPER-3489:
-----------------------------------------

I don't consider either of these sensitive information. 

Note that LOG.isWarnEnabled is an optimization. (see https://stackoverflow.com/questions/963492/in-log4j-does-checking-isdebugenabled-before-logging-improve-performance
- it's in the context of debug but essentially the same thing)

> Possible information leakage to log without LOG configuration control LOG.isWarnEnabled()
> -----------------------------------------------------------------------------------------
>
>                 Key: ZOOKEEPER-3489
>                 URL: https://issues.apache.org/jira/browse/ZOOKEEPER-3489
>             Project: ZooKeeper
>          Issue Type: Bug
>          Components: java client, security
>         Environment: 	Ubuntu 16.04.3 LTS
> 	Open JDK version "1.8.0_191" build 25.191-b12
>            Reporter: xiaoqin.fu
>            Priority: Major
>
>    In org.apache.zookeeper.ClientCnxn$SendThread, statements LOG.warn(....) don't have
LOG configuration controls.	
>         void readResponse(ByteBuffer incomingBuffer) throws IOException {
>             ......
> 			LOG.warn("Got server path " + event.getPath()
> 					+ " which is too short for chroot path "
> 					+ chrootPath);
> 			......					
>         }
> 	Sensitive information about event path and chroot path may be leaked. The LOG.isWarnEnabled()
conditional statement should be added:
> 	    void readResponse(ByteBuffer incomingBuffer) throws IOException {
>             ......
> 			if (LOG.isWarnEnabled())
> 				LOG.warn("Got server path " + event.getPath()
> 					+ " which is too short for chroot path "
> 					+ chrootPath);
> 			......					
>         }



--
This message was sent by Atlassian JIRA
(v7.6.14#76016)

Mime
View raw message