Andrea Cosentino created CAMEL-24717:
----------------------------------------
Summary: camel-opa - the producer health check publishes the
bearerToken in its id
Key: CAMEL-24717
URL: https://issues.apache.org/jira/browse/CAMEL-24717
Project: Camel
Issue Type: Bug
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
h2. Problem
The producer health check added in CAMEL-24644 builds its id from the endpoint
URI:
{code:java}
producerHealthCheck = new OpaProducerHealthCheck(
configuration.getServerUrl(), configuration.getBearerToken(),
getEndpoint().getPolicyPath(), getEndpoint().getEndpointUri());
{code}
{{OpaProducer}}, and the id is used verbatim:
{code:java}
public OpaProducerHealthCheck(String serverUrl, String bearerToken, String
policyPath, String id) {
super("camel", "producer:opa-" + id);
{code}
{{DefaultEndpoint.getEndpointUri()}} returns the raw, *unsanitized* URI -
unlike {{URISupport.sanitizeUri()}}, it does not mask secrets. So a producer
configured with {{bearerToken}} publishes that token as part of its
health-check id, and health-check ids are exposed in the health output
({{/q/health}}, JMX, the health developer console).
h2. Reproduction
A route with
{{from("direct:go").to("opa:authz/allow?serverUrl=http://localhost:8181&bearerToken=s3cr3t-token";)}},
reading the registered check out of the {{producers}} repository, gives:
{noformat}
healthCheckId =
producer:opa-opa://authz/allow?bearerToken=s3cr3t-token&serverUrl=http://localhost:8181
LEAKS TOKEN = true
{noformat}
Note that producer health checks are globally disabled by default, so the
repository has to be enabled ({{camel.health.producersEnabled=true}}) for this
to surface - but that is a supported and documented configuration, not an
exotic one.
h2. Why the endpoint URI was used
It was a deliberate fix, in the review of PR #26191, for a real problem: the id
was previously the policy path alone, so two endpoints pointing at different
OPA servers with the same policy path got the same id. Since
{{AbstractHealthCheck.equals}} compares by id, the second endpoint's shutdown
then deregistered the first. The endpoint URI is unique within a
{{CamelContext}} and fixed that - it just carries the token along with it.
h2. Proposal
Keep the endpoint URI as the source of uniqueness, but run it through
{{URISupport.sanitizeUri()}} before it becomes the id, so {{bearerToken}} is
masked as {{xxxxxx}} while {{serverUrl}} still distinguishes endpoints.
{{bearertoken}} is already a {{SensitiveUtils}} keyword, so the masking is
automatic.
Apply the same to the {{opa.serverUrl}} detail reported by the check, which is
also unsanitized and would expose credentials in a {{http://user:pass@host}}
style URL.
This is the same trade-off {{RemoteFileProducerHealthCheck}} makes - it
identifies itself by {{getConfiguration().getHost()}} rather than the full URI,
precisely because FTP URIs carry passwords.
h2. Scope
{{main}} only. 4.23.0 is not released, so the component has never shipped with
this - no released version is affected and no security advisory is needed.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
