This Bugzilla instance is a read-only archive of historic NetBeans bug reports. To report a bug in NetBeans please follow the project's instructions for reporting issues.

Bug 211964 - Sensitive information is logged into IDE log file
Summary: Sensitive information is logged into IDE log file
Status: VERIFIED WONTFIX
Alias: None
Product: javaee
Classification: Unclassified
Component: Amazon Cloud (show other bugs)
Version: 7.2
Hardware: All All
: P2 normal (vote)
Assignee: David Konecny
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-05-02 12:50 UTC by Petr Jiricka
Modified: 2012-05-03 07:52 UTC (History)
0 users

See Also:
Issue Type: DEFECT
Exception Reporter:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Petr Jiricka 2012-05-02 12:50:06 UTC
In case of connection failure, the IDE prints out sensitive connection data (Access Key ID, which is part of login credentials, and Signature, which is presumably derived from the login credentials) to the IDE log file. See the excerpt below, I replaced the sensitive bits by 'IDeletedThis'.

INFO [com.amazonaws.request]: Sending Request: POST https://elasticbeanstalk.us-east-1.amazonaws.com / Parameters: (Action: CreateStorageLocation, SignatureMethod: HmacSHA256, AWSAccessKeyId: IDeletedThis, SignatureVersion: 2, Version: 2010-12-01, Signature: IDeletedThis, Timestamp: 2012-05-02T12:39:00.327Z, ) 
INFO [org.apache.http.impl.client.DefaultHttpClient]: I/O exception (java.net.SocketException) caught when connecting to the target host: Broken pipe
INFO [org.apache.http.impl.client.DefaultHttpClient]: Retrying connect
WARNING [com.amazonaws.http.AmazonHttpClient]: Unable to execute HTTP request: Connect to elasticbeanstalk.us-east-1.amazonaws.com/elasticbeanstalk.us-east-1.amazonaws.com/207.171.168.69 timed out
Comment 1 David Konecny 2012-05-02 22:30:53 UTC
It is actually Amazon SDK who is logging this and not us so I assume they know what they are doing and this is safe. AWSAccessKeyId is basically a username and Signature is a hash of some sort which I presume is useless without Secret Access Key.
Comment 2 Petr Jiricka 2012-05-03 07:52:33 UTC
Ok, thanks for confirming.