Graylog2 / Graylog2/graylog2-server
REST API /streams/{streamId} returns password as clear text
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
When you issue a GET request for a specific stream `http://172.17.0.42:12900/streams/55116235e4b020d47079443a` and the configuration data in the stream contains a password, the password field is returned as clear text (see `CONFIG_AMQP_PASSWORD` and password `guest`):
```
{
"creator_user_id": "admin",
"outputs": [
{
"creator_user_id": "admin",
"configuration": {
"CONFIG_AMQP_SERVER_NAME": "172.17.0.44",
"CONFIG_AMQP_PUBLISH_TARGET": "EXCHANGE",
"CONFIG_AMQP_VIRTUAL_HOST": "/",
"CONFIG_AMQP_SERVER_PORT": 5672,
"CONFIG_AMQP_EXCHANGE_NAME": "mySuperExchange",
"CONFIG_AMQP_USER_NAME": "guest",
"CONFIG_AMQP_ROUTING_KEY": "#",
"CONFIG_AMQP_PASSWORD": "guest"
},
"created_at": "2015-03-30T13:32:38.548+0000",
"id": "55195076e4b067075020c785",
"title": "amqp",
"type": "biz.dfch.j.graylog.plugin.output.AmqpClientClass",
"content_pack": null
}
],
"description": "Default metrics stream",
"created_at": "2015-03-24T13:10:13.764Z",
"disabled": false,
"rules": [
{
"field": "message",
"stream_id": "55116235e4b020d47079443a",
"id": "55116246e4b020d47079444e",
"type": 1,
"inverted": false,
"value": "metrics"
}
],
"id": "55116235e4b020d47079443a",
"title": "Metrics",
"content_pack": null
}
```
This issue relates to graylog2/graylog2-web-interface#1134 . The fix was obviously only done in web interface (but must be applied to the underlying REST service).
Contributor guide
Assessment
This issue has not been assessed yet.