apache/cloudstack
1
0
Fork 0
mirror of https://github.com/apache/cloudstack.git synced 2025-12-16 10:32:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

fixed Password Exposure in IPMI Tool Command Execution (#12028)

Browse Source
This commit is contained in:
YoulongChen 2025-11-13 16:10:36 +08:00 committed by GitHub
parent f0a0936675
commit 028dd86945
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 20 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
utils/src/main/java/org/apache/cloudstack/utils/process/ProcessRunner.java
View File

@ -67,11 +67,13 @@ public final class ProcessRunner {
public ProcessRunner(ExecutorService executor) { public ProcessRunner(ExecutorService executor) {
this.executor = executor; this.executor = executor;
commandLogReplacements.add(new Ternary<>("ipmitool", "-P\\s+\\S+", "-P *****")); commandLogReplacements.add(new Ternary<>("ipmitool", "-P\\s+\\S+", "-P *****"));
commandLogReplacements.add(new Ternary<>("ipmitool", "(?i)password\\s+\\S+\\s+\\S+", "password **** ****"));
} }
/** /**
* Executes a process with provided list of commands with a max default timeout * Executes a process with provided list of commands with a max default timeout
* of 5 minutes * of 5 minutes
*
* @param commands list of string commands * @param commands list of string commands
* @return returns process result * @return returns process result
*/ */
@ -82,6 +84,7 @@ public final class ProcessRunner {
/** /**
* Executes a process with provided list of commands with a given timeout that is less * Executes a process with provided list of commands with a given timeout that is less
* than or equal to DEFAULT_MAX_TIMEOUT * than or equal to DEFAULT_MAX_TIMEOUT
*
* @param commands list of string commands * @param commands list of string commands
* @param timeOut timeout duration * @param timeOut timeout duration
* @return returns process result * @return returns process result
@ -109,14 +112,16 @@ public final class ProcessRunner {
} }
}); });
try { try {
logger.debug("Waiting for a response from command [{}]. Defined timeout: [{}].", commandLog, timeOut.getStandardSeconds()); logger.debug("Waiting for a response from command [{}]. Defined timeout: [{}].", commandLog,
timeOut.getStandardSeconds());
retVal = processFuture.get(timeOut.getStandardSeconds(), TimeUnit.SECONDS); retVal = processFuture.get(timeOut.getStandardSeconds(), TimeUnit.SECONDS);
} catch (ExecutionException e) { } catch (ExecutionException e) {
logger.warn("Failed to complete the requested command [{}] due to execution error.", commands, e); logger.warn("Failed to complete the requested command [{}] due to execution error.", commandLog, e);
retVal = -2; retVal = -2;
stdError = e.getMessage(); stdError = e.getMessage();
} catch (TimeoutException e) { } catch (TimeoutException e) {
logger.warn("Failed to complete the requested command [{}] within timeout. Defined timeout: [{}].", commandLog, timeOut.getStandardSeconds(), e); logger.warn("Failed to complete the requested command [{}] within timeout. Defined timeout: [{}].",
commandLog, timeOut.getStandardSeconds(), e);
retVal = -1; retVal = -1;
stdError = "Operation timed out, aborted."; stdError = "Operation timed out, aborted.";
} finally { } finally {

12
utils/src/test/java/org/apache/cloudstack/utils/process/ProcessRunnerTest.java
View File

@ -60,4 +60,16 @@ public class ProcessRunnerTest {
Assert.assertTrue(log.contains(password)); Assert.assertTrue(log.contains(password));
Assert.assertEquals(1, countSubstringOccurrences(log, password)); Assert.assertEquals(1, countSubstringOccurrences(log, password));
} }
@Test
public void testRemoveCommandSensitiveInfoForLoggingIpmiPasswordCommand() {
String userId = "3";
String newPassword = "Sup3rSecr3t!";
String command = String.format("/usr/bin/ipmitool user set password %s %s", userId, newPassword);
String log = processRunner.removeCommandSensitiveInfoForLogging(command);
Assert.assertFalse(log.contains(userId));
Assert.assertFalse(log.contains(newPassword));
Assert.assertTrue(log.contains("password **** ****"));
}
} }