[Lookup] LookupExtractorFactoryMapContainer will cause jdbc password leak issue
Open
Security
Uncategorized problem report
- Dominant language
- Java
- Stars
- 14.1k
- Forks
- 3.8k
- Avg merge
- 2d 58m
- Merged PRs (30d)
- 233
Description
### Affected Version
### Description
Coordinator use LookupExtractorFactoryMapContainer instead of LookupExtractorFactoryContainer to store lookup spec, so there is no PasswordProvider to protect jdbc password.
Anyone could use GET /druid/coordinator/v1/lookups/config/all find them.
Contributor guide
Research direction
Start at LookupExtractorFactoryMapContainer and LookupExtractorFactoryContainer, then trace the Coordinator endpoint GET /druid/coordinator/v1/lookups/config/all. Confirm how JDBC passwords are exposed and identify the existing PasswordProvider path; done means the endpoint no longer reveals the password while lookup configuration still works.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100