[GEODE-9354] Refactor ArgumentRedactor and add tests for ssl-*store-password props

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.12.4, 1.13.4
• Fix Version/s: 1.12.5, 1.13.5, 1.14.0, 1.15.0
• Component/s: logging
• Labels: GeodeOperationAPI pull-request-available
• Assignee: Kirk Lund
• Reporter: Kirk Lund
• Created: 04/Jun/21 19:55
• Updated: 26/Jul/22 13:17
• Resolved: 17/Aug/21 08:57

Description

Refactor ArgumentRedactor to clean it up and make sure it's efficient.

Add test coverage for log statements containing:

-Dgemfire.ssl-truststore-password=<PASSWORD>
-Dgemfire.ssl-keystore-password=<PASSWORD>

—
Related to CVE-2021-34797 in which logging is vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "javax.net.ssl", or "security-". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.

Fixed in https://github.com/apache/geode/pull/6641.

Backported to:

• 1.14 in https://github.com/apache/geode/pull/6747
• 1.13 in https://github.com/apache/geode/pull/6749
• 1.12 in https://github.com/apache/geode/pull/6750

Issue Links

• links to: GitHub Pull Request #6641
• links to: GitHub Pull Request #6747
• links to: GitHub Pull Request #6749
• links to: GitHub Pull Request #6750