Uploaded image for project: 'ZooKeeper'
  1. ZooKeeper
  2. ZOOKEEPER-3989

GenerateLoad needs to use log for protecting sensitive data

    XMLWordPrintableJSON

    Details

    • Type: Improvement
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 3.4.11, 3.4.13
    • Fix Version/s: 3.7.0
    • Component/s: tests

      Description

      n methods of org.apache.zookeeper.test.system.GenerateLoad,

      public static void main(String[] args) throws InterruptedException,
      KeeperException, NoAvailableContainers, DuplicateNameException,
      NoAssignmentException {
      ......
      if (!statusWatcher.waitConnected(5000))

      { System.err.println("Could not connect to " + args[0]); return; }


      ......
      String mode = getMode(parts[i]);
      if (mode.equals("leader"))

      { zkHostPort = new StringBuilder(parts[i]); System.out.println("Connecting exclusively to " + zkHostPort.toString()); break outer; }

      try

      { String cmdNumber[] = line.split(" "); ...... }

      catch (NumberFormatException e)

      { System.out.println("Not a valid number: " + e.getMessage()); }

      ......
      }
      }
      Sensitive data about args[0], zkHostPort, and cmdNumber are directly printed and may leak.
      For security, log should be used to record these data, as well as log in other classes such as org.apache.zookeeper.server.ZooKeeperServer:
      LOG = LoggerFactory.getLogger(GenerateLoad.class);
      ......
      LOG.error("Could not connect to " + args[0]);
      ......
      LOG.info("Connecting exclusively to " + zkHostPort.toString());
      ......
      LOG.error("Not a valid number: " + e.getMessage());

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                xiaoqin.fu xiaoqin.fu
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 1.5h
                  1.5h