Tarantool development patches archive
 help / color / mirror / Atom feed
From: Igor Munkin <imun@tarantool.org>
To: Maria <maria.khaydich@tarantool.org>
Cc: tarantool-patches@dev.tarantool.org, v.shpilevoy@tarantool.org
Subject: Re: [Tarantool-patches] [PATCH] box: replication shouldn't leak user password
Date: Wed, 26 Feb 2020 19:14:38 +0300	[thread overview]
Message-ID: <20200226161438.GL404@tarantool.org> (raw)
In-Reply-To: <20191212212543.37466-1-maria.khaydich@tarantool.org>

Masha,

Thanks, the patch LGTM considering Vlad's remarks and review fix on top.
Please don't forget to squash it with the original patch.

On 13.12.19, Maria wrote:
> It was possible to leak user password through setting 'replication'
> configuration option in first box.cfg invocation. This happened due
> to unconditional logging in load_cfg function. The patch introduces
> conditional logging.
> 
> Closes #4493
> ---
> Issue:
> https://github.com/tarantool/tarantool/issues/4493
> Branch:
> https://github.com/tarantool/tarantool/tree/eljashm/gh-4493-box.cfg-log-may-leak-passwords
> 
>  src/box/lua/load_cfg.lua   |  3 +++
>  test/box/load_cfg.result   | 37 +++++++++++++++++++++++++++++++++++++
>  test/box/load_cfg.test.lua | 14 ++++++++++++++
>  test/box/lua/cfg_test6.lua | 10 ++++++++++
>  4 files changed, 64 insertions(+)
>  create mode 100644 test/box/load_cfg.result
>  create mode 100644 test/box/load_cfg.test.lua
>  create mode 100644 test/box/lua/cfg_test6.lua
> 

<snipped>

> -- 
> 2.20.1 (Apple Git-117)
> 

-- 
Best regards,
IM

  parent reply	other threads:[~2020-02-26 16:19 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-12-12 21:25 Maria
2019-12-17 21:56 ` Vladislav Shpilevoy
2019-12-24 11:12   ` Maria Khaydich
2019-12-24 16:46     ` Vladislav Shpilevoy
2020-02-26 16:14 ` Igor Munkin [this message]
2020-03-03 17:26   ` Maria Khaydich
2020-03-05  4:49 ` Kirill Yukhin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200226161438.GL404@tarantool.org \
    --to=imun@tarantool.org \
    --cc=maria.khaydich@tarantool.org \
    --cc=tarantool-patches@dev.tarantool.org \
    --cc=v.shpilevoy@tarantool.org \
    --subject='Re: [Tarantool-patches] [PATCH] box: replication shouldn'\''t leak user password' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox