xiaoqin.fu created ZOOKEEPER-3504:
-------------------------------------
Summary: An information leakage from FileTxnSnapLog to log:
Key: ZOOKEEPER-3504
URL: https://issues.apache.org/jira/browse/ZOOKEEPER-3504
Project: ZooKeeper
Issue Type: Bug
Components: security, server
Affects Versions: 3.4.14, 3.5.5, 3.4.13, 3.4.12, 3.4.11
Reporter: xiaoqin.fu
In org.apache.zookeeper.server.persistence.FileTxnSnapLog, the statement
LOG.debug don't have LOG controls:
public void processTransaction(TxnHeader hdr,DataTree dt,
Map<Long, Integer> sessions, Record txn)
throws KeeperException.NoNodeException {
......
if (rc.err != Code.OK.intValue()) {
LOG.debug("Ignoring processTxn failure hdr:" + hdr.getType()
+ ", error: " + rc.err + ", path: " + rc.path);
}
......
}
Sensitive information about hdr type or rc path was leaked. The conditional
statement LOG.isDebugEnabled() should be added:
public void processTransaction(TxnHeader hdr,DataTree dt,
Map<Long, Integer> sessions, Record txn)
throws KeeperException.NoNodeException {
......
if (rc.err != Code.OK.intValue()) {
if (LOG.isDebugEnabled())
LOG.debug("Ignoring processTxn failure hdr:" +
hdr.getType()
+ ", error: " + rc.err + ", path: " + rc.path);
}
......
}
--
This message was sent by Atlassian JIRA
(v7.6.14#76016)
