Skip to content

FELIX-6570 - Components webconsole-plugin shows password in clear text #177

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cziegeler merged 3 commits into from
Oct 13, 2022
Merged

FELIX-6570 - Components webconsole-plugin shows password in clear text #177

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1603106
FELIX-6570 - Components webconsole-plugin shows password in clear text
sagarmiglani Oct 13, 2022
c19bf16
FELIX-6570 - Components webconsole-plugin shows password in clear text
sagarmiglani Oct 13, 2022
bf0e0e1
FELIX-6570 - Components webconsole-plugin shows password in clear text
sagarmiglani Oct 13, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions ...s/src/main/java/org/apache/felix/webconsole/plugins/ds/internal/ConfigurationSupport.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,9 @@
import org.osgi.framework.BundleContext;
import org.osgi.util.tracker.ServiceTracker;

import java.util.Collection;
import java.util.Collections;

public class ConfigurationSupport {

private final ServiceTracker<Object, Object> configAdminTracker;
Expand Down Expand Up @@ -73,4 +76,19 @@ public boolean isConfigurable(final Bundle providingBundle, final String pid)
}
return false;
}

/**
* Returns a Collection of IDs of Password Attributes Definitions for given bundle and configuration PIDs
* @param bundle The Bundle providing the component
* @param configurationPids A non-null configuration pid
* @return <code>Collection<String></code>
*/
public Collection<String> getPasswordAttributeDefinitionIds(final Bundle bundle, final String[] configurationPids) {
Object metaTypeService = this.metatypeTracker.getService();
if (bundle == null || metaTypeService == null) {
return Collections.emptySet();
}
return new MetatypeSupport().getPasswordAttributeDefinitionIds(metaTypeService, bundle, configurationPids);
}

}
44 changes: 44 additions & 0 deletions ...ins/ds/src/main/java/org/apache/felix/webconsole/plugins/ds/internal/MetatypeSupport.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,15 @@
package org.apache.felix.webconsole.plugins.ds.internal;

import org.osgi.framework.Bundle;
import org.osgi.service.metatype.AttributeDefinition;
import org.osgi.service.metatype.MetaTypeInformation;
import org.osgi.service.metatype.MetaTypeService;
import org.osgi.service.metatype.ObjectClassDefinition;

import java.util.Collection;
import java.util.Collections;
import java.util.Set;
import java.util.HashSet;

public class MetatypeSupport
{
Expand All @@ -39,4 +46,41 @@ public boolean check(final Object obj, final Bundle providingBundle, final Strin
}
return false;
}

public Collection<String> getPasswordAttributeDefinitionIds(final Object mts, final Bundle bundle, final String[] configurationPids) {
MetaTypeService metaTypeService = (MetaTypeService) mts;
MetaTypeInformation metaTypeInformation = metaTypeService.getMetaTypeInformation(bundle);
if (metaTypeInformation == null) {
return Collections.emptySet();
}

Set<String> allPasswordIds = new HashSet<>();
for(String configurationPid: configurationPids) {
allPasswordIds.addAll(getPasswordIds(metaTypeInformation, configurationPid));
}

return allPasswordIds;
}

private Set<String> getPasswordIds(MetaTypeInformation metaTypeInformation, String configurationPid) {
AttributeDefinition[] defs = null;
try {
ObjectClassDefinition ocd = metaTypeInformation.getObjectClassDefinition(configurationPid, null);
defs = ocd.getAttributeDefinitions(ObjectClassDefinition.ALL);
} catch (final IllegalArgumentException ignore) {
// just ignore this exception?
}

Set<String> passwordsDefIds = new HashSet<>();
if (defs != null) {
for (int i = 0; i < defs.length; i++) {
if (defs[i].getType() == AttributeDefinition.PASSWORD) {
passwordsDefIds.add(defs[i].getID());
}
}
}

return passwordsDefIds;
}

}
30 changes: 24 additions & 6 deletions ...ns/ds/src/main/java/org/apache/felix/webconsole/plugins/ds/internal/WebConsolePlugin.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -477,6 +477,14 @@ else if ( config != null )
private void listProperties(JSONWriter jw, ComponentDescriptionDTO desc, ComponentConfigurationDTO component) throws IOException
{
Map<String, Object> props = component != null ? component.properties : desc.properties;

// Is this the right way to get bundle and configuration PID?
Bundle bundle = this.getBundleContext().getBundle(0).getBundleContext().getBundle(desc.bundle.id);
String[] configurationPids = desc.configurationPid;

Collection<String> passwordPropertyIds =
this.optionalSupport.getPasswordAttributeDefinitionIds(bundle, configurationPids);

if (props != null)
{
jw.object();
Expand All @@ -491,9 +499,14 @@ private void listProperties(JSONWriter jw, ComponentDescriptionDTO desc, Compone
final StringBuilder b = new StringBuilder();
b.append(key).append(" = ");

Object prop = props.get(key);
prop = WebConsoleUtil.toString(prop);
b.append(prop);
if (passwordPropertyIds.contains(key)) {
b.append("********");
} else {
Object prop = props.get(key);
prop = WebConsoleUtil.toString(prop);
b.append(prop);
}

jw.value(b.toString());
}
jw.endArray();
Expand All @@ -512,9 +525,14 @@ private void listProperties(JSONWriter jw, ComponentDescriptionDTO desc, Compone
final StringBuilder b = new StringBuilder();
b.append(key).append(" = ");

Object prop = props.get(key);
prop = WebConsoleUtil.toString(prop);
b.append(prop);
if (passwordPropertyIds.contains(key)) {
b.append("********");
} else {
Object prop = props.get(key);
prop = WebConsoleUtil.toString(prop);
b.append(prop);
}

jw.value(b.toString());
}
jw.endArray();
Expand Down