influxdata / influxdata/influxdb-client-csharp
I used System Informer to check the HTTPS commands sent by influxdb-client-csharp and found that the Token, which is sensitive information, was not promptly cleared from memory.
- Dominant language
- C#
- Stars
- 377
- Forks
- 93
- Avg merge
- 9m
- Merged PRs (30d)
- 2
Description
__Steps to reproduce:__
List the minimal actions needed to reproduce the behavior.
1. Use GetOrganizationApi.FindOrganizationsAsync() to get organization list.
2. Use System Informer to get the application memory and found that we can read the Token information in the memory
__Expected behavior:__
the token sensitive information in memory is not visible.
__Actual behavior:__
the token sensitive information in memory is visible.
__Specifications:__
- InfluxDB Version: 4.14.0
- Platform: Windows 10
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the issue with GetOrganizationApi.FindOrganizationsAsync() on Windows 10 and inspect the process with System Informer, as described. Trace how the token is handled during the request and define completion as preventing sensitive token data from remaining visibly readable in process memory.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100