fix(jans-auth): plaintext passwords logged from TokenRestWebServiceImpl with DEBUG log level #8959

[yuriyz]

Description

fix(jans-auth): plaintext passwords logged from TokenRestWebServiceImpl with DEBUG log level

Target issue

closes #8959

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The pull request focuses on improving the security of the ServerUtil class in the Jans Auth Server application by enhancing the prepareForLogs() method to mask sensitive information, such as client_secret and password, and adding a new test case to verify the behavior of the method when dealing with the "password" parameter.

Expand for full summary

Summary:

The code changes in this pull request focus on improving the security of the ServerUtil class in the Jans Auth Server application. The key changes include:

1. Enhancing the prepareForLogs() method to mask sensitive information, such as client_secret and password, by replacing the values with asterisks (*****) before logging or displaying them. This is a positive security practice that helps prevent the inadvertent exposure of sensitive data.

2. Adding a new test case to the ServerUtilTest class to verify the behavior of the prepareForLogs() method when dealing with the "password" parameter. This ensures that the security-critical functionality of the method is thoroughly tested and validated, which helps maintain the overall security posture of the application.

Overall, these changes demonstrate a security-conscious approach to application development and are a good step towards improving the security of the Jans Auth Server application.

Files Changed:

1. jans-auth-server/server/src/main/java/io/jans/as/server/util/ServerUtil.java:

   • The prepareForLogs() method has been updated to mask sensitive information, such as client_secret and password, by replacing the values with asterisks (*****) before logging or displaying them.
   • This change helps prevent the inadvertent exposure of sensitive data, which is an important security measure.

2. jans-auth-server/server/src/test/java/io/jans/as/server/util/ServerUtilTest.java:

   • A new test case prepareForLogs_whenCalled_shouldNotHaveClearTextPassword() has been added to verify that the prepareForLogs() method correctly masks the "password" parameter.
   • This new test case, along with the existing test case for the "client_secret" parameter, helps ensure the security-critical functionality of the prepareForLogs() method is thoroughly tested and validated.

Code Analysis

We ran 9 analyzers against 2 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	1 finding

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[sonarqubecloud]

Quality Gate passed for 'jans-linux-setup'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'jans-cli'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'jans-config-api-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'jans-core'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'Jans-Keycloak-Link'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'Fido2 API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'SCIM API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud