apache/pulsar

[SECURITY] Hardcode the password in KeyManagerProxy

Open

#14,325 opened on Feb 16, 2022

View on GitHub
 (4 comments) (0 reactions) (1 assignee)Java (3,485 forks)batch import
Stalehelp wantedlifecycle/staletype/bug

Repository metrics

Stars
 (13,697 stars)
PR merge metrics
 (Avg merge 3d 10h) (146 merged PRs in 30d)

Description

https://github.com/apache/pulsar/blob/64dc5374b6f6eb59a69a036697e16c8b21a31b16/pulsar-common/src/main/java/org/apache/pulsar/common/util/KeyManagerProxy.java#L50

Is it ok to hardcode the password in KeyManagerProxy? It may have a security risk

Contributor guide

Research direction
Review the KeyManagerProxy class to understand how the hardcoded password is used and propose a secure alternative such as environment variables or a secrets manager.
Tech stack
java
Domain
backend
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
1
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
JavaGit
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70