read-attribute operation is leaking value when user is not authorized to read that attribute -------------------------------------------------------------------------------------------- Key: WFLY-1985 URL: https://issues.jboss.org/browse/WFLY-1985 Project: WildFly Issue Type: Sub-task Components: Domain Management, Security Reporter: Jakub Cechacek Assignee: Brian Stansberry Priority: Critical Labels: rbac-filed-by-qa Fix For: 8.0.0.CR1 This is affecting native interface and consequently CLI - HTTP and JMX have the correct behavior as they aren't simply forwarding the result of native interface. {code} [standalone@localhost:9990 /] :whoami(verbose=true) { "outcome" => "success", "result" => {"identity" => { "username" => "monitor", "realm" => "ManagementRealm" }} } [standalone@localhost:9990 /] /subsystem=datasources/data-source=ExampleDS:read-attribute(name=password) { "outcome" => "failed", "result" => "sa", "failure-description" => "JBAS013456: Unauthorized to execute operation 'read-attribute' for resource '[ (\"subsystem\" => \"datasources\"), (\"data-source\" => \"ExampleDS\") ]' -- \"Permission denied\"", "rolled-back" => true } {code}