[KARAF-4205] Privacy Violation

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 4.0.3
• Assignee: Unassigned
• Reporter: Eduardo Aguinaga
• Created: 15/Dec/15 15:56
• Updated: 28/Jan/17 05:09
• Resolved: 28/Jan/17 05:09

Description

HP Fortify SCA and SciTools Understand were used to perform an application security analysis of the karaf source code.

The method find() in GogoParser.java mishandles confidential information, which can compromise user privacy and is often illegal.

File: shell/core/src/main/java/org/apache/karaf/shell/support/parsing/GogoParser.java
Line: 332

GogoParser.java, lines 329-333:
329 while (level != 0) {
330 if (eof())

{ 331 throw new RuntimeException("Eof found in the middle of a compound for '" 332 + target + deeper + "', begins at " + context(start)); 333 }