فهرست منبع

HUE-7997 [backend] Python LDAP library exposes password

Testing Done:
When ldap trace logging is enabled, the password is redact.

*** ldap://w2k8-1.ad.xxx.cloudera.com:3268  - SimpleLDAPObject.simple_bind (['ccoxxxer@AD.SEC.CLOUDERA.COM', '*******', None, None],{})
Prakash Ranade 7 سال پیش
والد
کامیت
5d0af64
1فایلهای تغییر یافته به همراه5 افزوده شده و 1 حذف شده
  1. 5 1
      desktop/core/ext-py/python-ldap-2.3.13/Lib/ldap/ldapobject.py

+ 5 - 1
desktop/core/ext-py/python-ldap-2.3.13/Lib/ldap/ldapobject.py

@@ -84,11 +84,15 @@ class SimpleLDAPObject:
     self._ldap_object_lock.acquire()
     if __debug__:
       if self._trace_level>=1:# and func.__name__!='result':
+        redact = [i for i in args]
+        if 'simple_bind' in func.__name__:
+          redact[1] = "*******"
         self._trace_file.write('*** %s - %s (%s,%s)\n' % (
           self._uri,
           self.__class__.__name__+'.'+func.__name__,
-          repr(args),repr(kwargs)
+          repr(redact),repr(kwargs)
         ))
+
         if self._trace_level>=3:
           traceback.print_stack(limit=self._trace_stack_limit,file=self._trace_file)
     try: