[JBoss JIRA] (WFLY-13838) plain text j_password appears in the legacy audit log
by Hisanobu Okuda (Jira)
[ https://issues.redhat.com/browse/WFLY-13838?page=com.atlassian.jira.plugi... ]
Hisanobu Okuda updated WFLY-13838:
----------------------------------
Git Pull Request: https://github.com/wildfly/wildfly/pull/13553 (was: https://github.com/wildfly/wildfly/pull/13547)
> plain text j_password appears in the legacy audit log
> -----------------------------------------------------
>
> Key: WFLY-13838
> URL: https://issues.redhat.com/browse/WFLY-13838
> Project: WildFly
> Issue Type: Bug
> Components: Web (Undertow)
> Affects Versions: 20.0.1.Final
> Reporter: Hisanobu Okuda
> Assignee: Hisanobu Okuda
> Priority: Major
> Fix For: 21.0.0.Beta1
>
> Attachments: web-form-auth.tar.gz
>
>
> The unmasked value of j_password is written in the audit log as `[parameters=guest::,guest::,]`.
> {code}
> 12:48:45,385 TRACE [org.jboss.security.audit] (default task-1) [Success]principal=guest;request=[/test:cookies=[javax.servlet.http.Cookie@46b3f22]:headers=Origin=http://localhost:8080,Cookie=JSESSIONID=dbDjUA6QeA2UXCyyPaqdSSgE4Kjd0_JvxUG7-pBx.localhost,Accept=text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8,User-Agent=Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:79.0) Gecko/20100101 Firefox/79.0,Connection=keep-alive,Referer=http://localhost:8080/test/secure/index.jsp,Host=localhost:8080,Accept-Encoding=gzip, deflate,DNT=1,Upgrade-Insecure-Requests=1,Accept-Language=en-US,en;q=0.5,Content-Length=33,Content-Type=application/x-www-form-urlencoded,][parameters=guest::,guest::,][attributes=];message=UT000030: User guest successfully authenticated.;Source=org.wildfly.extension.undertow.security.AuditNotificationReceiver;
> {code}
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
4 years, 3 months
[JBoss JIRA] (WFWIP-354) Bootable JAR - jboss-maven-dist plugin param doesn't work as expected
by Marek Kopecky (Jira)
Marek Kopecky created WFWIP-354:
-----------------------------------
Summary: Bootable JAR - jboss-maven-dist plugin param doesn't work as expected
Key: WFWIP-354
URL: https://issues.redhat.com/browse/WFWIP-354
Project: WildFly WIP
Issue Type: Bug
Reporter: Marek Kopecky
Assignee: Jean Francois Denise
Related RFE: EAP7-1385
This usage of jboss-maven-dist plugin param doesn't work as expected:
[<jboss-maven-dist>/home/mkopecky/jboss-eap-custom-maven-repository/maven-repository</jboss-maven-dist>|https://github.com/marekkopecky/Resteasy/commit/fb29381a9ef9a709f33481af8020a649db002980#diff-8c7ea03eb619e46657b96e8fe8d4f09eR248]
Steps to reproduce:
# clone resteasy 3.12 with this commit: https://github.com/marekkopecky/Resteasy/commit/fb29381a9ef9a709f33481af8...
# update jboss-maven-dist plugin param to your custom repo path
# rm -rf ~/.m2/repository/xerces/xercesImpl/2.12.0.SP03
# set REPO variable (eg. "REPO=/home/mkopecky/jboss-eap-custom-maven-repository/maven-repository")
# build start tests {code}mvn install -DskipTests -Dmaven.repo.local=$REPO
cd testsuite
mvn install:install-file -Dpackaging=pom -Dfile=pom.xml -DpomFile=pom.xml -Dmaven.repo.local=$REPO
cd integration-tests
mvn clean install -Dts.bootable -Ddefault=false -Ddisable.microprofile.tests -Dserver.version=21.0.0.Beta1-SNAPSHOT -Dserver.home=placeholder -Dmaven.repo.local=$REPO -Dmaven.test.redirectTestOutputToFile=false{code}
# see the results: org.jboss.modules.ModuleLoadException, because xercesImpl 2.12.0.SP03 is downloaded in custom repo, but not present in .m2
cc [~fburzigo], [~yersan]
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
4 years, 3 months
[JBoss JIRA] (WFLY-13838) plain text j_password appears in the legacy audit log
by Darran Lofthouse (Jira)
[ https://issues.redhat.com/browse/WFLY-13838?page=com.atlassian.jira.plugi... ]
Darran Lofthouse reassigned WFLY-13838:
---------------------------------------
Assignee: Hisanobu Okuda (was: Flavia Rainone)
> plain text j_password appears in the legacy audit log
> -----------------------------------------------------
>
> Key: WFLY-13838
> URL: https://issues.redhat.com/browse/WFLY-13838
> Project: WildFly
> Issue Type: Bug
> Components: Web (Undertow)
> Affects Versions: 20.0.1.Final
> Reporter: Hisanobu Okuda
> Assignee: Hisanobu Okuda
> Priority: Major
> Fix For: 21.0.0.Beta1
>
> Attachments: web-form-auth.tar.gz
>
>
> The unmasked value of j_password is written in the audit log as `[parameters=guest::,guest::,]`.
> {code}
> 12:48:45,385 TRACE [org.jboss.security.audit] (default task-1) [Success]principal=guest;request=[/test:cookies=[javax.servlet.http.Cookie@46b3f22]:headers=Origin=http://localhost:8080,Cookie=JSESSIONID=dbDjUA6QeA2UXCyyPaqdSSgE4Kjd0_JvxUG7-pBx.localhost,Accept=text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8,User-Agent=Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:79.0) Gecko/20100101 Firefox/79.0,Connection=keep-alive,Referer=http://localhost:8080/test/secure/index.jsp,Host=localhost:8080,Accept-Encoding=gzip, deflate,DNT=1,Upgrade-Insecure-Requests=1,Accept-Language=en-US,en;q=0.5,Content-Length=33,Content-Type=application/x-www-form-urlencoded,][parameters=guest::,guest::,][attributes=];message=UT000030: User guest successfully authenticated.;Source=org.wildfly.extension.undertow.security.AuditNotificationReceiver;
> {code}
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
4 years, 3 months