luchua-bc opened a new pull request #3210: URL: https://github.com/apache/ambari/pull/3210
## What changes were proposed in this pull request? Sensitive information like username and password shall not be sent over the cleartext HTTP channel. Basic authentication only obfuscates username/password in Base64 encoding, which can be easily recognized and reversed. The class <code>ambari-funtest/src/test/java/org/apache/ambari/funtest/server/AmbariHttpWebRequest.java</code> sends username and password in basic authentication over an HTTP connection. Sending username and password using the HTTP protocol violates CWE-522 "Insufficiently Protected Credentials". Although the vulnerable class is in the <code>ambari-funtest</code> package, as Ambari is a popular repository of Apache that is watched and used by many users and organizations, whose code could be extended and customized, the issue shall be resolved in my opinion. ## How was this patch tested? The change is minimal and only involves one class. Please investigate and consider merging the PR as well as opening a security advisory if you agree this is a valid issue. Thanks, @luchua-bc ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected]
