tarantool / tarantool / 18127541710

88%

push

github

ssl: eliminate sensitive data leak in cfg options

Before this patch sensitive ssl data (password, paths to certificates,
path to private key) could leak into log file during configuring
`listen` and `replication` option of box.cfg. This could lead to serious
security risks.

Now we fix this issue by extending the functionality of the
`purge_ensitive_data_from_uri` function so that it can process not only
string uris, but also table uris with `uri` and `params` options. After
this patch next uri parameters will not be printed in log file:
`password` and all params which contain "ssl_" prefix.

Also we rename main cleaner functions so that user can understand that it
can purge not only `uri.password`, but also other sensitive params (e.g.
ssl params).

Needed for tarantool/tarantool-ee#1438

NO_DOC=<ee bugfix>
NO_TEST=<ee bugfix>
NO_CHANGELOG=<ee bugfix>

71296 of 125131 branches covered (56.98%)

104800 of 119610 relevant lines covered (87.62%)

1354162.92 hits per line