[SLING-12093] ResourceResolver.getAttribute(...) might return sensitive information

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: Resource Resolver 1.11.0
• Component/s: ResourceResolver
• Assignee: Unassigned
• Reporter: Konrad Windszus
• Created: 12/Oct/23 13:32
• Updated: 16/Oct/23 18:06

Description

The method ResourceResolver.getAttribute(...) retrieves a named attribute from either

• the underlying resource provider or
• the authentication info passed to the factory

In addition it filters out some attributes supposed to contain sensitive information (https://github.com/apache/sling-org-apache-sling-resourceresolver/blob/d9e90e455c0f71e84414bb09c83d7e678f1a788e/src/main/java/org/apache/sling/resourceresolver/impl/helper/ResourceResolverControl.java#L400)

Although there is some JCR specific authentication info filtered in https://github.com/apache/sling-org-apache-sling-jcr-resource/blob/685c50921085941f4cbb1a3ccdbf90bad0605527/src/main/java/org/apache/sling/jcr/resource/internal/helper/jcr/JcrResourceProvider.java#L676, this is not-effective as the authentication info is retrieved without consulting any resource provider.

This affects the attribute user.jcr.credentials.

Issue Links

• is broken by: SLING-4750 New Resource Provider API
• is related to: SLING-11723 Expose more authentication information from ResourceResolver