[CXF-6222] Password can end up in log file

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.4, 2.7.15
• Component/s: Core
• Estimated Complexity: Unknown
• Assignee: Colm O hEigeartaigh
• Reporter: Donald Kwakkel
• Created: 26/Jan/15 14:07
• Updated: 16/Feb/15 16:09
• Resolved: 27/Jan/15 15:30

Description

In AuthPolicyValidatingInterceptor when a policy has no username, password can end up in log file.

 public void handleMessage(Message message) throws Fault {

        AuthorizationPolicy policy = message.get(AuthorizationPolicy.class);
        if (policy == null || policy.getUserName() == null || policy.getPassword() == null) {
            String name = null;
            String password = null;
            if (policy != null) {
                name = policy.getUserName();
                password = policy.getPassword();
            }
            org.apache.cxf.common.i18n.Message errorMsg = 
                new org.apache.cxf.common.i18n.Message("NO_USER_PASSWORD", 
                                                       BUNDLE, 
                                                       name, password);
            LOG.warning(errorMsg.toString());
            throw new SecurityException(errorMsg.toString());
        }