Skip to content

Commit aab881b

Browse files
devdeepdevdeep
committed
CLOUDSTACK-5942: The agent at places logs the password of the user. It should mask the
password from the message string before writing to the log. Made a change to do so.
1 parent dad98ef commit aab881b

3 files changed

Lines changed: 23 additions & 13 deletions

File tree

‎plugins/hypervisors/hyperv/DotNet/ServerResource/HypervResource/CloudStackTypes.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -254,7 +254,7 @@ public static VolumeObjectTO ParseJson(dynamic json)
254254
// Assert
255255
if (result.dataStore == null || (result.primaryDataStore == null && result.nfsDataStore == null))
256256
{
257-
String errMsg = "VolumeObjectTO missing dataStore in spec " + volumeObjectTOJson.ToString();
257+
String errMsg = "VolumeObjectTO missing dataStore in spec " + Utils.CleanString(volumeObjectTOJson.ToString());
258258
logger.Error(errMsg);
259259
throw new ArgumentNullException(errMsg);
260260
}
@@ -292,7 +292,7 @@ private static void GuessFileExtension(VolumeObjectTO volInfo)
292292
}
293293
else
294294
{
295-
String errMsg = "VolumeObjectTO missing dataStore in spec " + volInfo.ToString();
295+
String errMsg = "VolumeObjectTO missing dataStore in spec " + Utils.CleanString(volInfo.ToString());
296296
logger.Error(errMsg);
297297
throw new ArgumentNullException(errMsg);
298298
}

‎plugins/hypervisors/hyperv/DotNet/ServerResource/HypervResource/HypervResourceController.cs‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,7 @@ public JContainer AttachCommand([FromBody]dynamic cmd)
207207
{
208208
using (log4net.NDC.Push(Guid.NewGuid().ToString()))
209209
{
210-
logger.Info(CloudStackTypes.AttachCommand + cmd.ToString());
210+
logger.Info(CloudStackTypes.AttachCommand + Utils.CleanString(cmd.ToString()));
211211

212212
string details = null;
213213
bool result = false;
@@ -268,7 +268,7 @@ public JContainer DetachCommand([FromBody]dynamic cmd)
268268
{
269269
using (log4net.NDC.Push(Guid.NewGuid().ToString()))
270270
{
271-
logger.Info(CloudStackTypes.DettachCommand + cmd.ToString());
271+
logger.Info(CloudStackTypes.DettachCommand + Utils.CleanString(cmd.ToString()));
272272

273273
string details = null;
274274
bool result = false;
@@ -485,7 +485,7 @@ private static JArray ReturnCloudStackTypedJArray(object ansContent, string ansT
485485
{
486486
JObject ansObj = Utils.CreateCloudStackObject(ansType, ansContent);
487487
JArray answer = new JArray(ansObj);
488-
logger.Info(ansObj.ToString());
488+
logger.Info(Utils.CleanString(ansObj.ToString()));
489489
return answer;
490490
}
491491

@@ -496,7 +496,7 @@ public JContainer CreateCommand([FromBody]dynamic cmd)
496496
{
497497
using (log4net.NDC.Push(Guid.NewGuid().ToString()))
498498
{
499-
logger.Info(CloudStackTypes.CreateCommand + cmd.ToString());
499+
logger.Info(CloudStackTypes.CreateCommand + Utils.CleanString(cmd.ToString()));
500500

501501
string details = null;
502502
bool result = false;
@@ -603,7 +603,7 @@ public JContainer PrimaryStorageDownloadCommand([FromBody]dynamic cmd)
603603
{
604604
using (log4net.NDC.Push(Guid.NewGuid().ToString()))
605605
{
606-
logger.Info(CloudStackTypes.PrimaryStorageDownloadCommand + cmd.ToString());
606+
logger.Info(CloudStackTypes.PrimaryStorageDownloadCommand + Utils.CleanString(cmd.ToString()));
607607
string details = null;
608608
bool result = false;
609609
long size = 0;
@@ -871,7 +871,7 @@ public JContainer CreateStoragePoolCommand([FromBody]dynamic cmd)
871871
{
872872
using (log4net.NDC.Push(Guid.NewGuid().ToString()))
873873
{
874-
logger.Info(CloudStackTypes.CreateStoragePoolCommand + cmd.ToString());
874+
logger.Info(CloudStackTypes.CreateStoragePoolCommand + Utils.CleanString(cmd.ToString()));
875875
object ansContent = new
876876
{
877877
result = true,
@@ -889,7 +889,7 @@ public JContainer ModifyStoragePoolCommand([FromBody]dynamic cmd)
889889
{
890890
using (log4net.NDC.Push(Guid.NewGuid().ToString()))
891891
{
892-
logger.Info(CloudStackTypes.ModifyStoragePoolCommand + cmd.ToString());
892+
logger.Info(CloudStackTypes.ModifyStoragePoolCommand + Utils.CleanString(cmd.ToString()));
893893
string details = null;
894894
string localPath;
895895
StoragePoolType poolType;
@@ -1045,7 +1045,7 @@ public JContainer StartCommand([FromBody]dynamic cmd)
10451045
{
10461046
using (log4net.NDC.Push(Guid.NewGuid().ToString()))
10471047
{
1048-
logger.Info(CloudStackTypes.StartCommand + cmd.ToString()); // TODO: Security hole? VM data printed to log
1048+
logger.Info(CloudStackTypes.StartCommand + Utils.CleanString(cmd.ToString()));
10491049
string details = null;
10501050
bool result = false;
10511051

@@ -1144,7 +1144,7 @@ public JContainer CreateObjectCommand([FromBody]dynamic cmd)
11441144
{
11451145
using (log4net.NDC.Push(Guid.NewGuid().ToString()))
11461146
{
1147-
logger.Info(CloudStackTypes.CreateObjectCommand + cmd.ToString());
1147+
logger.Info(CloudStackTypes.CreateObjectCommand + Utils.CleanString(cmd.ToString()));
11481148

11491149
bool result = false;
11501150
string details = null;
@@ -1315,7 +1315,7 @@ public JContainer CopyCommand(dynamic cmd)
13151315
using (log4net.NDC.Push(Guid.NewGuid().ToString()))
13161316
{
13171317
// Log command *after* we've removed security details from the command.
1318-
logger.Info(CloudStackTypes.CopyCommand + cmd.ToString());
1318+
logger.Info(CloudStackTypes.CopyCommand + Utils.CleanString(cmd.ToString()));
13191319

13201320
bool result = false;
13211321
string details = null;
@@ -1691,7 +1691,7 @@ public JContainer GetStorageStatsCommand([FromBody]dynamic cmd)
16911691
{
16921692
using (log4net.NDC.Push(Guid.NewGuid().ToString()))
16931693
{
1694-
logger.Info(CloudStackTypes.GetStorageStatsCommand + cmd.ToString());
1694+
logger.Info(CloudStackTypes.GetStorageStatsCommand + Utils.CleanString(cmd.ToString()));
16951695
bool result = false;
16961696
string details = null;
16971697
long capacity = 0;

‎plugins/hypervisors/hyperv/DotNet/ServerResource/HypervResource/Utils.cs‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,16 @@ public static void GetShareDetails(string remoteUNC, out long capacity, out long
164164
capacity = totalNumberOfBytes > 0 ? (long)totalNumberOfBytes : 0;
165165
}
166166

167+
public static string CleanString(string stringToClean)
168+
{
169+
string cleanString = null;
170+
string regexQueryString = "(&|%26)?(password|accesskey|secretkey)(=|%3D).*?(?=(%26|[&'\"]))";
171+
string regexJson = "\"(password|accesskey|secretkey)\":\".*?\",?";
172+
cleanString = System.Text.RegularExpressions.Regex.Replace(stringToClean, regexQueryString, "");
173+
cleanString = System.Text.RegularExpressions.Regex.Replace(cleanString, regexJson, "");
174+
return cleanString;
175+
}
176+
167177
// from http://stackoverflow.com/a/2541569/939250
168178
#region imports
169179
[DllImport("advapi32.dll", SetLastError = true)]

0 commit comments

Comments
 (0)