[
https://issues.apache.org/jira/browse/CAMEL-24717?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino updated CAMEL-24717:
-------------------------------------
Fix Version/s: 4.23.0
> camel-opa - the producer health check publishes the bearerToken in its id
> -------------------------------------------------------------------------
>
> Key: CAMEL-24717
> URL: https://issues.apache.org/jira/browse/CAMEL-24717
> Project: Camel
> Issue Type: Bug
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> h2. Problem
> The producer health check added in CAMEL-24644 builds its id from the
> endpoint URI:
> {code:java}
> producerHealthCheck = new OpaProducerHealthCheck(
> configuration.getServerUrl(), configuration.getBearerToken(),
> getEndpoint().getPolicyPath(), getEndpoint().getEndpointUri());
> {code}
> {{OpaProducer}}, and the id is used verbatim:
> {code:java}
> public OpaProducerHealthCheck(String serverUrl, String bearerToken, String
> policyPath, String id) {
> super("camel", "producer:opa-" + id);
> {code}
> {{DefaultEndpoint.getEndpointUri()}} returns the raw, *unsanitized* URI -
> unlike {{URISupport.sanitizeUri()}}, it does not mask secrets. So a producer
> configured with {{bearerToken}} publishes that token as part of its
> health-check id, and health-check ids are exposed in the health output
> ({{/q/health}}, JMX, the health developer console).
> h2. Reproduction
> A route with
> {{from("direct:go").to("opa:authz/allow?serverUrl=http://localhost:8181&bearerToken=s3cr3t-token";)}},
> reading the registered check out of the {{producers}} repository, gives:
> {noformat}
> healthCheckId =
> producer:opa-opa://authz/allow?bearerToken=s3cr3t-token&serverUrl=http://localhost:8181
> LEAKS TOKEN = true
> {noformat}
> Note that producer health checks are globally disabled by default, so the
> repository has to be enabled ({{camel.health.producersEnabled=true}}) for
> this to surface - but that is a supported and documented configuration, not
> an exotic one.
> h2. Why the endpoint URI was used
> It was a deliberate fix, in the review of PR #26191, for a real problem: the
> id was previously the policy path alone, so two endpoints pointing at
> different OPA servers with the same policy path got the same id. Since
> {{AbstractHealthCheck.equals}} compares by id, the second endpoint's shutdown
> then deregistered the first. The endpoint URI is unique within a
> {{CamelContext}} and fixed that - it just carries the token along with it.
> h2. Proposal
> Keep the endpoint URI as the source of uniqueness, but run it through
> {{URISupport.sanitizeUri()}} before it becomes the id, so {{bearerToken}} is
> masked as {{xxxxxx}} while {{serverUrl}} still distinguishes endpoints.
> {{bearertoken}} is already a {{SensitiveUtils}} keyword, so the masking is
> automatic.
> Apply the same to the {{opa.serverUrl}} detail reported by the check, which
> is also unsanitized and would expose credentials in a
> {{http://user:pass@host}} style URL.
> This is the same trade-off {{RemoteFileProducerHealthCheck}} makes - it
> identifies itself by {{getConfiguration().getHost()}} rather than the full
> URI, precisely because FTP URIs carry passwords.
> h2. Scope
> {{main}} only. 4.23.0 is not released, so the component has never shipped
> with this - no released version is affected and no security advisory is
> needed.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
