DaanHoogland opened a new pull request, #14588:
URL: https://github.com/apache/cloudstack/pull/14588
Async APIs that take `userdata` stored it in `async_job.job_cmd_info` as
plain base64, along with the other request parameters. Cloud-init often
contains passwords, so anyone with DB read access could recover them. The same
parameters were also published unmasked on the event bus as `cmdInfo` of async
job events.
This PR reuses the existing `AsyncJobDataHelper` encryption by setting
`requestHasSensitiveInfo = true` on the async APIs that accept userdata:
- `deployVirtualMachine`, `deployVnfAppliance`, `createVMFromBackup` (user
and admin versions)
- `createAutoScaleVmProfile`, `updateAutoScaleVmProfile`
This also encrypts the deploy `password` parameter, which is stored in the
same column.
Supporting changes:
- `AsyncJobDaoImpl.countPendingJobs` used SQL `LIKE` on `job_cmd_info`,
which cannot match encrypted rows. It now filters pending jobs on the decrypted
value. Without this, the pending backup job check would stop working for
`createVMFromBackup`.
- `ApiServer`: `userdata` is added to the existing `sensitiveFields` set.
That set is now applied through a single `isSensitiveField()` helper to both
the request trace log and the `cmdInfo` of published async job events.
Note: event consumers now see `******` for every field the set matches,
and a `password` value is fully masked instead of showing its first character.
Fixes: #14530
### Types of changes
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] Build/CI
- [ ] Test (unit or integration test code)
#### Bug Severity
- [ ] BLOCKER
- [ ] Critical
- [ ] Major
- [x] Minor
- [ ] Trivial
### How Has This Been Tested?
Unit tests:
- `AsyncJobDataHelperTest`: `job_cmd_info` is encrypted for each of the
userdata commands
- `AsyncJobDaoImplTest`: `countPendingJobs` matches on the decrypted command
info
- `ApiServerTest`: userdata is masked in the async job event description
#### How did you try to break this feature and the system with this change?
Checked every consumer of `job_cmd_info`. Most read it through
`AsyncJobVO.getCmdInfo()`, which decrypts it. The only SQL match on the column
was `countPendingJobs`, which is fixed here. Rows written before the upgrade
are plain JSON, and `decryptIfNeeded` returns those unchanged.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
