apache / apache/druid

PasswordProvider abstraction could be abused for races

Open
#6,666 6 comments 0 reactions 0 assignees View on GitHub
Bug Security stale
Dominant language
Java
Stars
14.1k
Forks
3.8k
Avg merge
2d 31m
Merged PRs (30d)
209

Description

Some classes that have multiple `PasswordProvider` fields could inherently be subject to races:
- `SSLClientConfig`
- `MySQLConnectorConfig`
- `ClientSSLContextBuilder`
- `TLSServerConfig`
- `BasicHTTPAuthenticator`
- `BasicAuthDBConfig`
- `AWSCredentialsConfig`

Contributor guide

Open the contributing guide

Research direction

Start by reading PasswordProvider and inspecting the listed classes: SSLClientConfig, MySQLConnectorConfig, ClientSSLContextBuilder, TLSServerConfig, BasicHTTPAuthenticator, BasicAuthDBConfig, and AWSCredentialsConfig. Trace how their multiple PasswordProvider fields may be accessed concurrently. Done means the race risk is resolved consistently across the affected classes and the relevant concurrent behavior is covered by tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.