fix that log sensitive infomation in cmd of script #12024

YLChen-007 · 2025-11-08T02:34:07Z

Description

This PR fixes that log sensitive infomation in cmd of cloud.utils.script.Script. #12005

codecov · 2025-11-08T07:04:07Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 4.03%. Comparing base (cd5bb09) to head (1988400).
⚠️ Report is 2 commits behind head on 4.20.

❗ There is a different number of reports uploaded between BASE (cd5bb09) and HEAD (1988400). Click for more details.

HEAD has 1 upload less than BASE

Flag BASE (cd5bb09) HEAD (1988400)

unittests 1 0

Additional details and impacted files

@@              Coverage Diff              @@
##               4.20   #12024       +/-   ##
=============================================
- Coverage     17.10%    4.03%   -13.07%     
=============================================
  Files          5255      402     -4853     
  Lines        466415    32713   -433702     
  Branches      54746     5831    -48915     
=============================================
- Hits          79763     1319    -78444     
+ Misses       377768    31239   -346529     
+ Partials       8884      155     -8729

Flag	Coverage Δ
uitests	`4.03% <ø> (?)`
unittests	`?`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

DaanHoogland · 2025-11-10T08:28:56Z

@blueorangutan package

blueorangutan · 2025-11-10T08:30:05Z

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-11-10T09:40:25Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 15701

DaanHoogland · 2025-11-10T12:30:26Z

@blueorangutan test

blueorangutan · 2025-11-10T12:32:06Z

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-11-11T02:43:56Z

[SF] Trillian test result (tid-14794)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 48295 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr12024-t14794-kvm-ol8.zip
Smoke tests completed. 140 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
test_create_pvlan_network	`Error`	0.09	test_pvlan.py

Copilot

Pull Request Overview

This PR addresses a security issue where sensitive information (such as passwords) was being logged in plain text within the Script class. The fix introduces a new addSensitive() method to mark specific command arguments as sensitive, ensuring they are masked with "******" in logs and command-line representations.

Key changes:

Added sensitiveArgIndices Set to track which arguments contain sensitive data
Implemented addSensitive() method for explicitly marking sensitive arguments
Updated all logging statements throughout the execute() methods to conditionally log sanitized messages when sensitive arguments are present

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 13 comments.

File	Description
Script.java	Core implementation adding sensitive argument tracking and comprehensive logging changes to mask sensitive data
ScriptTest.java	Test cases validating that sensitive arguments are properly masked in command-line output
LibvirtUpdateHostPasswordCommandWrapper.java	Updated to use `addSensitive()` for password arguments
CitrixUpdateHostPasswordCommandWrapper.java	Updated logging to mask password in debug output

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

utils/src/main/java/com/cloud/utils/script/Script.java

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…guments

…ithub.com/YLChen-007/cloudstack into my-fix-420-mask-script-cmd-sensitive-info

…when debugging

Copilot

Pull Request Overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

utils/src/main/java/com/cloud/utils/script/Script.java

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

DaanHoogland · 2025-11-12T07:56:39Z

@blueorangutan package

blueorangutan · 2025-11-12T07:58:04Z

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

DaanHoogland · 2025-11-12T12:18:00Z

@YLChen-007 ,

09:03:01 [ERROR] /jenkins/workspace/acs-centos8-pkg-builder/dist/rpmbuild/BUILD/cloudstack-4.20.3.0-SNAPSHOT/utils/src/main/java/com/cloud/utils/script/Script.java:47:8: Unused import - org.apache.cloudstack.utils.security.KeyStoreUtils. [UnusedImports]

YLChen-007 · 2025-11-12T12:21:24Z

@YLChen-007 ,

09:03:01 [ERROR] /jenkins/workspace/acs-centos8-pkg-builder/dist/rpmbuild/BUILD/cloudstack-4.20.3.0-SNAPSHOT/utils/src/main/java/com/cloud/utils/script/Script.java:47:8: Unused import - org.apache.cloudstack.utils.security.KeyStoreUtils. [UnusedImports]

I will delete this import.

github-actions · 2026-01-22T10:59:22Z

This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.

DaanHoogland · 2026-01-22T13:27:31Z

@blueorangutan package

blueorangutan · 2026-01-22T13:28:35Z

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-01-22T14:21:09Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 16497

utils/src/main/java/com/cloud/utils/script/Script.java

DaanHoogland · 2026-01-22T14:32:44Z

@blueorangutan package

blueorangutan · 2026-01-22T14:34:36Z

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-01-22T15:38:31Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16501

fix that log sensitive infomation in cmd of script

5bae182

boring-cyborg bot added component:kvm component:XenServer labels Nov 8, 2025

Remove unnecessary line break in Script.java

f9a05f5

DaanHoogland requested review from Copilot, shwstppr and sureshanaparti and removed request for Copilot and sureshanaparti November 11, 2025 08:54

Copilot started reviewing on behalf of DaanHoogland November 11, 2025 08:55 View session

Copilot finished reviewing on behalf of DaanHoogland November 11, 2025 08:57

Copilot AI reviewed Nov 11, 2025

View reviewed changes

YLChen-007 and others added 4 commits November 11, 2025 17:30

Update utils/src/main/java/com/cloud/utils/script/Script.java

7dc5b2b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Refactor logging in Script class to simplify handling of sensitive ar…

d15379b

…guments

Merge branch 'my-fix-420-mask-script-cmd-sensitive-info' of https://g…

30fed1a

…ithub.com/YLChen-007/cloudstack into my-fix-420-mask-script-cmd-sensitive-info

Improve command logging in Script class to include full command line …

64a6547

…when debugging

DaanHoogland requested a review from Copilot November 11, 2025 14:37

Copilot started reviewing on behalf of DaanHoogland November 11, 2025 14:38 View session

Copilot finished reviewing on behalf of DaanHoogland November 11, 2025 14:40

Copilot AI reviewed Nov 11, 2025

View reviewed changes

utils/src/main/java/com/cloud/utils/script/Script.java Show resolved Hide resolved

utils/src/main/java/com/cloud/utils/script/Script.java Outdated Show resolved Hide resolved

Remove unused _passwordCommand flag from Script class to simplify code

a617571

Update utils/src/main/java/com/cloud/utils/script/Script.java

2468400

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

apache deleted a comment from blueorangutan Nov 12, 2025

DaanHoogland linked an issue Nov 12, 2025 that may be closed by this pull request

Security: Inadequate Password Masking in Script Execution Framework Exposes Credentials Across Multiple Log Levels #12005

Open

Remove unused import for KeyStoreUtils

45a66f0

abh1sar added this to the 4.20.3 milestone Jan 7, 2026

github-actions bot added the status:has-conflicts label Jan 22, 2026

Merge branch '4.20' into my-fix-420-mask-script-cmd-sensitive-info

1988400

github-actions bot removed the status:has-conflicts label Jan 22, 2026

DaanHoogland reviewed Jan 22, 2026

View reviewed changes

utils/src/main/java/com/cloud/utils/script/Script.java Show resolved Hide resolved

Update utils/src/main/java/com/cloud/utils/script/Script.java

c6ee04f

fix that log sensitive infomation in cmd of script #12024

Are you sure you want to change the base?

fix that log sensitive infomation in cmd of script #12024

Conversation

YLChen-007 commented Nov 8, 2025

Description

Uh oh!

codecov bot commented Nov 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

DaanHoogland commented Nov 10, 2025

Uh oh!

blueorangutan commented Nov 10, 2025

Uh oh!

blueorangutan commented Nov 10, 2025

Uh oh!

DaanHoogland commented Nov 10, 2025

Uh oh!

blueorangutan commented Nov 10, 2025

Uh oh!

blueorangutan commented Nov 11, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

DaanHoogland commented Nov 12, 2025

Uh oh!

blueorangutan commented Nov 12, 2025

Uh oh!

DaanHoogland commented Nov 12, 2025

Uh oh!

YLChen-007 commented Nov 12, 2025

Uh oh!

github-actions bot commented Jan 22, 2026

Uh oh!

DaanHoogland commented Jan 22, 2026

Uh oh!

blueorangutan commented Jan 22, 2026

Uh oh!

blueorangutan commented Jan 22, 2026

Uh oh!

Uh oh!

DaanHoogland commented Jan 22, 2026

Uh oh!

blueorangutan commented Jan 22, 2026

Uh oh!

blueorangutan commented Jan 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

codecov bot commented Nov 8, 2025 •

edited

Loading