[HDFS-11665] HttpFSServerWebServer$deprecateEnv may leak secret

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.0-alpha4
• Fix Version/s: 3.0.0-alpha4
• Component/s: httpfs, security
• Target Version/s: 3.0.0-alpha4
• Assignee: John Zhuge
• Reporter: John Zhuge
• Created: 18/Apr/17 05:31
• Updated: 18/Apr/17 17:11
• Resolved: 18/Apr/17 16:49

Description

May print warning message with secret in deprecated env var or matching property:

    LOG.warn("Environment variable {} = '{}' is deprecated and overriding"
            + " property {} = '{}', please set the property in {} instead.",
        varName, value, propName, propValue, confFile);

Issue Links

• is broken by: HDFS-10860 Switch HttpFS from Tomcat to Jetty
• is related to: HADOOP-14317 KMSWebServer$deprecateEnv may leak secret