[
https://issues.apache.org/jira/browse/KAFKA-20964?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18109591#comment-18109591
]
Shantanu commented on KAFKA-20964:
----------------------------------
I'll take this.
*Issue:* {{ScramParser}} concatenates the user-supplied {{saltedpassword}} into
{{FormatterException}} when Base64 decoding fails (same for {{salt}}).
{{kafka-storage format --add-scram}} prints {{getMessage()}} to stderr.
*Solution:* Use a generic decode-failure message and keep the
{{IllegalArgumentException}} as the cause. Do not echo the value.
*Tests (fail on trunk, pass after):*
- Invalid {{saltedpassword}} Base64 (valid salt so we reach that decoder):
message is {{Failed to decode given saltedPassword}} and does not include the
input.
- Invalid {{salt}} Base64: message is {{Failed to decode given salt}} and does
not include the input.
Existing tests only cover valid Base64 and missing-field errors, so they never
exercised the decode-failure path.
> ScramParser flagged by security scanner
> ---------------------------------------
>
> Key: KAFKA-20964
> URL: https://issues.apache.org/jira/browse/KAFKA-20964
> Project: Kafka
> Issue Type: Bug
> Reporter: Gergely Harmadás
> Assignee: Shantanu
> Priority: Major
>
> Pasting the analysis of the security tool
> [ScramParser|https://github.com/apache/kafka/blob/trunk/metadata/src/main/java/org/apache/kafka/metadata/storage/ScramParser.java#L141-L147]
> {quote}The constructor
> {code:java}
> PerMechanismData(
> ScramMechanism mechanism,
> String configString
> ){code}
> mishandles confidential information in line 145
> {code:java}
> throw new FormatterException("Failed to decode given saltedPassword: " +
> saltedPasswordString, e);{code}
> which can compromise user privacy and is often illegal. Mishandling private
> information, such as customer passwords or social security numbers, can
> compromise user privacy and is often illegal.
> The error message is thrown after a failed Base64-decoding, so most likely
> the provided saltedPassword is a malformed input. However, it is still a
> defensive best practice to avoid echoing user-supplied credential-adjacent
> fields in error messages, since user input can’t be controlled.
> {quote}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
