Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid configuration data output via Configuration.toString() #84

Closed
oswaldobapvicjr opened this issue Jul 6, 2022 · 2 comments · Fixed by #87
Closed

Avoid configuration data output via Configuration.toString() #84

oswaldobapvicjr opened this issue Jul 6, 2022 · 2 comments · Fixed by #87
Assignees
Labels
2.x The target Confectory version good first issue Good for newcomers security Security fixes

Comments

@oswaldobapvicjr
Copy link
Owner

Describe the bug/vulnerability
When the StringSource is used, the actual data is visible via Configuration's toString() method, which is not desirable.
Note: This does not happen with other sources, such as URL or File, in which the system displays the path to the source, instead.

To Reproduce

  1. Create a new Configuration using the StringSource containing a valid JSON document or properties file
  2. Print the Configuration to the system console

Expected behavior
The system should not print the actual data, which can contain sensitive information that might be accessed without proper tracing. Instead, the system could print some "dummy"/random path (similar to the approach used by the Configuration objects generated by the mergers).

Screenshots
Example of toString result generated by string source (current behavior, unexpected):
{"namespace":"test","precedence":0,"source":"StringSource(myFileName=config1\n myString=cust1)"}

Example of toString result generated by merger (desirable also for string source):
{"namespace":"test","precedence":20,"source":"DummySource(7728eee7-a79a-42ed-aec8-1d83b39ed7b2)"}

Desktop:

  • OS: Windows 11
  • Browser: N/A
  • Version: 2.1.0

Additional context
N/A

@oswaldobapvicjr oswaldobapvicjr added good first issue Good for newcomers 2.x The target Confectory version security Security fixes labels Jul 6, 2022
@oswaldobapvicjr oswaldobapvicjr changed the title Avoid sendind configuration data output via Configuration.toString() Avoid configuration data output via Configuration.toString() Jul 6, 2022
@stingermissile
Copy link
Contributor

How do you expect this change to be handled in the following test:
net.obvj.confectory.ConfigurationTest.toString_validString()
(line 96)
?

@oswaldobapvicjr
Copy link
Owner Author

oswaldobapvicjr commented Jul 10, 2022

How do you expect this change to be handled in the following test: net.obvj.confectory.ConfigurationTest.toString_validString() (line 96) ?

Hey @stingermissile!
Thank you for your interest in supporting the Confectory! 😃
I would like the Source part of the toString() output to be "StringSource(UUID)".
For example: StringSource(7728eee7-a79a-42ed-aec8-1d83b39ed7b2)
You may find a similar example on DummySource.java.
For the JUnit test, since the UUID is random, it's OK to evaluate the that the output contains at least the fixed part "StringSource".

oswaldobapvicjr added a commit that referenced this issue Aug 7, 2022
…String() (#87)

* Issue 84 : https://github.com/firstcontributions/first-contributions

* Added Simple Class Name to toString

* Added StringSource check to toString test, and removed commented code.

* final modifier added to uuid

Co-authored-by: stingermissile <omega.engine@bigpond.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
2.x The target Confectory version good first issue Good for newcomers security Security fixes
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants