Conversation
AuthInterceptor (openam-mcp-server) wrote the OpenAM session id at INFO when refreshing a near-expired token and the OAuth2 access token at WARN when userinfo rejected it; the Cassandra CTS adapter logged the whole CTS Token (tokenId included) when a field could not be read, and the Cassandra IdRepo logged the full attribute map - userPassword included - when setAttributes/setBinaryAttributes failed. A session id or token in a log file is enough to hijack the session. Log a masked prefix of the token instead, and only attribute names for the IdRepo. Tests capture the logger output and assert the raw values are absent. Closes CodeQL alerts java/sensitive-log OpenIdentityPlatform#243, OpenIdentityPlatform#246, OpenIdentityPlatform#247, OpenIdentityPlatform#252, OpenIdentityPlatform#270, OpenIdentityPlatform#271
vharseko
added
java
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three of our own components wrote credentials into log files:
AuthInterceptorlogged the OpenAM session id at INFO when refreshing a near-expired token (both the username/password and the OAuth paths) and the OAuth2 access token at WARN when/oauth2/userinforejected it.TokenStorageAdapterlogged the whole CTSToken(Token.toString()printscoreTokenIdand every attribute) when a field could not be read duringupdate.Repologged the full attribute map onsetAttributesfailure and insetBinaryAttributes; that map carriesuserPasswordfor Membership self-registration and OAuth account creation.A session id or access token in a log file is enough to hijack the session, so:
AuthInterceptor.maskToken()/TokenStorageAdapter.maskTokenId()keep a 4-character prefix and replace the rest with***(short values become***).RepologskeySet()only.AuthInterceptorTestattaches a logbackListAppenderand asserts the raw tokens never appear in the captured messages (both refresh paths and the invalid-userinfo path); newTokenStorageAdapterTestcovers the mask.Closes CodeQL
java/sensitive-logalerts #243, #246, #247, #252, #270, #271.