apache/cloudstack
1
0
Fork 0
mirror of https://github.com/apache/cloudstack.git synced 2025-10-26 08:42:29 +01:00
Code Issues Packages Projects Releases Wiki Activity

CLOUDSTACK-7370: Fixed password visible in plain text if password passed is in the end in url

Browse Source
This commit is contained in:
Anshul Gangwar 2014-08-19 14:17:21 +05:30 committed by Devdeep Singh
parent fa1156092e
commit d90a2d3962
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
utils/src/com/cloud/utils/StringUtils.java
View File

@ -159,7 +159,9 @@ public class StringUtils {
} }
// removes a password request param and it's value, also considering password is in query parameter value which has been url encoded // removes a password request param and it's value, also considering password is in query parameter value which has been url encoded
private static final Pattern REGEX_PASSWORD_QUERYSTRING = Pattern.compile("(&|%26)?((p|P)assword|accesskey|secretkey)(=|%3D).*?(?=(%26|[&'\"]))"); private static final Pattern REGEX_PASSWORD_QUERYSTRING = Pattern.compile("(&|%26)?[^(&|%26)]*((p|P)assword|accesskey|secretkey)(=|%3D).*?(?=(%26|[&'\"]))");
private static final Pattern REGEX_END_PASSWORD_QUERYSTRING = Pattern.compile("(&|%26)[^(&|%26)]*((p|P)assword|accesskey|secretkey)(=|%3D).*");
// removes a password/accesskey/ property from a response json object // removes a password/accesskey/ property from a response json object
private static final Pattern REGEX_PASSWORD_JSON = Pattern.compile("\"((p|P)assword|accesskey|secretkey)\":\\s?\".*?\",?"); private static final Pattern REGEX_PASSWORD_JSON = Pattern.compile("\"((p|P)assword|accesskey|secretkey)\":\\s?\".*?\",?");
@ -175,6 +177,7 @@ public class StringUtils {
String cleanResult = ""; String cleanResult = "";
if (stringToClean != null) { if (stringToClean != null) {
cleanResult = REGEX_PASSWORD_QUERYSTRING.matcher(stringToClean).replaceAll(""); cleanResult = REGEX_PASSWORD_QUERYSTRING.matcher(stringToClean).replaceAll("");
cleanResult = REGEX_END_PASSWORD_QUERYSTRING.matcher(cleanResult).replaceAll("");
cleanResult = REGEX_PASSWORD_JSON.matcher(cleanResult).replaceAll(""); cleanResult = REGEX_PASSWORD_JSON.matcher(cleanResult).replaceAll("");
Matcher detailsMatcher = REGEX_PASSWORD_DETAILS.matcher(cleanResult); Matcher detailsMatcher = REGEX_PASSWORD_DETAILS.matcher(cleanResult);
while (detailsMatcher.find()) { while (detailsMatcher.find()) {