[
https://issues.apache.org/jira/browse/ZOOKEEPER-5058?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
ASF GitHub Bot updated ZOOKEEPER-5058:
--------------------------------------
Labels: pull-request-available (was: )
> Remove special characters from ensemble name before logging in
> EnsembleAuthenticationProvider
> ---------------------------------------------------------------------------------------------
>
> Key: ZOOKEEPER-5058
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-5058
> Project: ZooKeeper
> Issue Type: Improvement
> Components: security, server
> Affects Versions: 3.9.5, 3.8.6
> Reporter: Andor Molnar
> Assignee: Andor Molnar
> Priority: Major
> Labels: pull-request-available
> Time Spent: 10m
> Remaining Estimate: 0h
>
> {{EnsembleAuthenticationProvider }}is intended to prevent a client from
> accidentally connecting to the wrong ZooKeeper ensemble. When a client sends
> a standard ZooKeeper {{auth}} request with scheme {{{}ensemble{}}}, the
> request is parsed by the normal network request path and dispatched to the
> provider.
> There is no sanitization step before the user-controlled value is emitted to
> the logger. Clients could corrupt the logfile in the same that we've seen in
> ZOOKEEPER-3979.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
