[DBCP-562] avoids exposing password via JMX

[fgdrf]

for see details see https://issues.apache.org/jira/browse/DBCP-562

Signed-off-by: Frank Gasdorf fgdrf@users.sourceforge.net

[garydgregory]

Well, since we cannot get rid of the method within a major release, we need to workaround that by perhaps making it return always null but only when publishing an implementation as a JMX object, which might mean creating a wrapper class that delegates all methods except getPassword().

[rhuddleston]

Any updates on the plans for this @fgdrf ? It shows up on snyk reports https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECOMMONS-559327 so would be nice if there was some fix. Thanks!

[fgdrf]

Well, since we cannot get rid of the method within a major release, we need to workaround that by perhaps making it return always null but only when publishing an implementation as a JMX object, which might mean creating a wrapper class that delegates all methods except getPassword().

How about creating a new interface, e.g. IDataSourcePassword is implemented by BasicDataSource and getPassword() method moves from BasicDataSourceMXBean to IDataSourcePassword .

Going to update this pull request with this approach ;)

[fgdrf]

build fails due to API incompatible change:

Error:  Failed to execute goal com.github.siom79.japicmp:japicmp-maven-plugin:0.15.3:cmp (default-cli) on project commons-dbcp2: There is at least one incompatibility: org.apache.commons.dbcp2.BasicDataSourceMXBean.getPassword():METHOD_REMOVED -> [Help 1]
Error:  
Error:  To see the full stack trace of the errors, re-run Maven with the -e switch.
Error:  Re-run Maven using the -X switch to enable full debug logging.
Error:  
Error:  For more information about the errors and possible solutions, please read the following articles:
Error:  [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
Error: Process completed with exit code 1.

[fgdrf]

here we go, finially found a solution by using StandardMBean.

[ManjunathMS35]

Hello, when could be the new release with this fix?

[garydgregory]

That's on my to-do list, pleas be patient, no guarantee, we are all volunteers, step one is to review... Gary

…

On Mon, May 10, 2021, 01:43 ManjunathMS35 ***@***.***> wrote: Hello, when could be the new release with this fix? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#38 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJB6NZKMIRSCAURVTJSQSTTM5XA5ANCNFSM4LB2TRIA> .

[garydgregory]

Please see git master.