github-advanced-security[bot] commented on code in PR #3635:
URL: https://github.com/apache/dubbo-go/pull/3635#discussion_r3755168485
##########
remoting/nacos/builder.go:
##########
@@ -43,6 +45,38 @@
newNacosConfigClient = nacosClient.NewNacosConfigClient
)
+// nacosClientPoolKey derives the gost client-pool key from the fields that
+// distinguish one nacos connection from another: server (endpoint/address),
+// namespace and the full credential set. Components pointing at the same
+// cluster (registry, config-center, metadata-report) resolve to the same key
+// and share one SDK client session instead of each opening its own.
+// Role-scoped client names must not be used as the key — they would defeat
+// the sharing.
+func nacosClientPoolKey(kind string, url *common.URL) string {
+ // GetNacosConfig ignores url.Location when an endpoint is set; mirror
+ // that here so URLs resolving to the same server set share one client.
+ server := url.GetParam(constant.NacosEndpoint, "")
+ if server == "" {
+ server = url.Location
+ }
+ // Credentials are part of the connection identity (clients
authenticated
+ // differently must never collapse into one pool entry), but they must
not
+ // appear in the key verbatim — the key may end up in logs. Fold the
full
+ // credential set into a fingerprint instead.
+ credentials := sha256.Sum256([]byte(strings.Join([]string{
+ url.GetParam(constant.NacosUsername, ""),
+ url.GetParam(constant.NacosPassword, ""),
+ url.GetParam(constant.NacosAccessKey, ""),
+ url.GetParam(constant.NacosSecretKey, ""),
+ }, "\n")))
Review Comment:
## CodeQL / Use of a broken or weak cryptographic hashing algorithm on
sensitive data
[Sensitive data (password)](1) is used in a hashing algorithm (SHA256) that
is insecure for password hashing, since it is not a computationally expensive
hash function.
[Show more
details](https://github.com/apache/dubbo-go/security/code-scanning/77)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
