Ericsson / ecaudit

Ericsson Audit plug-in for Apache Cassandra
Apache License 2.0
43 stars 36 forks source link

Password obfuscation in multi-line statements #180

Open eperott opened 3 years ago

eperott commented 3 years ago

Obfuscation of passwords in multi-line statements was improved in #170. However, as reported by @smiklosovic in a comment, the solution was not bullet proof.

For example, you can have a batch statement with multiple statements which are setting passwords. Even such a batch statement > is invalid, what we found is that it will be logged but the second password will not be obfuscated.

Everything is in this ticket https://issues.apache.org/jira/browse/CASSANDRA-16669

Opening this new ticket to follow up on this