Modify

#22846 closed enhancement (fixed)

[patch] Anonymize VM arguments in status reports

Reported by: gaben Owned by: team
Priority: normal Milestone: 23.04
Component: Core Version:
Keywords: information disclosure Cc:

Description

A JOSM instance in debugging can have special VM arguments which can contain sensitive information, like the user home dir. If someone creates bug report int that state, the VM arguments become visible.

See for example one of my previous report #22845, where I manually changed the -javaagent param to hide the username.

  • src/org/openstreetmap/josm/actions/ShowStatusReportAction.java

     
    159159                    text.format("WebStart package: %s%n", webStartDetails);
    160160                }
    161161            }
    162             // Add Gnome Atk wrapper details if found
     162            // Add Gnome ATK wrapper details if found
    163163            String atkWrapperDetails = platform.getAtkWrapperPackageDetails();
    164164            if (atkWrapperDetails != null) {
    165165                text.format("Java ATK Wrapper package: %s%n", atkWrapperDetails);
    166166            }
    167             // Add dependencies details if found
     167            // Add dependency details if found
    168168            for (String p : new String[] {
    169169                    "apache-commons-compress", "libcommons-compress-java",
    170170                    "apache-commons-jcs-core",
     
    207207                }
    208208            }
    209209            if (!vmArguments.isEmpty()) {
    210                 text.format("VM arguments: %s%n", vmArguments.toString().replace("\\\\", "\\"));
     210                text.format("VM arguments: %s%n", paramCleanup(vmArguments).toString().replace("\\\\", "\\"));
    211211            }
    212212        } catch (SecurityException e) {
    213213            Logging.trace(e);
     
    280280    }
    281281
    282282    /**
    283      * Shortens and removes private informations from a parameter used for status report.
     283     * Shortens and removes private information from a parameter used for status report.
    284284     * @param param parameter to cleanup
    285285     * @return shortened/anonymized parameter
    286286     */

Attachments (0)

Change History (3)

comment:1 by gaben, 21 months ago

Milestone: 23.0423.03

Maybe it fits in the March release :)

comment:2 by taylor.smock, 21 months ago

Milestone: 23.0323.04

Ticket retargeted after milestone closed

comment:3 by taylor.smock, 20 months ago

Resolution: fixed
Status: newclosed

In 18707/josm:

Fix #22846: Anonymize VM arguments in status reports (patch by gaben)

This is mostly useful if the user sets the JOSM home directory.

Modify Ticket

Change Properties
Set your email in Preferences
Action
as closed The owner will remain team.
as The resolution will be set.
The resolution will be deleted. Next status will be 'reopened'.

Add Comment


E-mail address and name can be saved in the Preferences .
 
Note: See TracTickets for help on using tickets.