jerome079 opened a new pull request, #10811:
URL: https://github.com/apache/cloudstack/pull/10811
### Description
This PR addresses a security issue where S3 credentials used for Secondary
Storage were being logged in plain text in CloudStack logs (`access.log` and
`management-server.log`). Even when debug logging is enabled, secret
credentials such as `accessKey` and `secretKey` should never appear in logs.
Fix details:
- Redacts the `accessKey` and `secretKey` from the `S3TO` object before
logging `DownloadCommand` in `NfsSecondaryStorageResource.java`.
- Adds a unit test in `NfsSecondaryStorageResourceTest.java` to verify that
credentials are redacted.
Steps to reproduce the issue:
1. Deploy CloudStack 4.20.0.0 with KVM and Ceph RGW S3 as Secondary Storage.
2. Create a Secondary Storage using S3 credentials.
3. Observe logs in `/var/log/cloudstack/management/access.log` or
`management-server.log` — credentials will be printed.
Fixes: #10339
### Types of changes
- [x] Bug fix (non-breaking change which fixes an issue)
- [x] test (unit or integration test code)
### Bug Severity
- [x] Major
### How Has This Been Tested?
- Added a unit test that mocks `S3TO` and verifies that
`setAccessKey("***REDACTED***")` and `setSecretKey("***REDACTED***")` are
called during `executeRequest`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscr...@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
