Gergely Harmadás created KAFKA-20964:
----------------------------------------
Summary: ScramParser flagged by security scanner
Key: KAFKA-20964
URL: https://issues.apache.org/jira/browse/KAFKA-20964
Project: Kafka
Issue Type: Bug
Reporter: Gergely Harmadás
Assignee: Gergely Harmadás
Pasting the analysis of the security tool
{quote}The constructor
{code:java}
PerMechanismData(
ScramMechanism mechanism,
String configString
){code}
mishandles confidential information in line 145
{code:java}
throw new FormatterException("Failed to decode given saltedPassword: " +
saltedPasswordString, e);{code}
which can compromise user privacy and is often illegal. Mishandling private
information, such as customer passwords or social security numbers, can
compromise user privacy and is often illegal.
The error message is thrown after a failed Base64-decoding, so most likely the
provided saltedPassword is a malformed input. However, it is still a defensive
best practice to avoid echoing user-supplied credential-adjacent fields in
error messages, since user input can’t be controlled.
{quote}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
