1193816 - Bugzilla login/password end up in logs because of SHA1 warning

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia::Bugzilla Lite, defect)

Description

[Mathieu Pillard [:mat]]

When looking at the logs posted in a bug by a foxfooding user, I noticed this line:

06-29 15:25:05.473  8091  8091 W Bugzilla Lite: [JavaScript Warning: "This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1." {file: "https://bugzilla.mozilla.org/rest/login?login=XXXXXX%40YYYYY.ZZZZ&password=WWWWWWW" line: 0}]

It might be a problem with an older version - I don't use Bugzilla Lite myself because of security issues regarding FxOS itself, so I can't easily check, but considering those logs often end up being posted in public bugs, even if that only happens infrequently it seems like a big deal.

Comment 1

[Dale Harvey (:daleharvey)]

Yup this is very bad, so this wont be affected by users who login via bugzilla 'oauth' which we just introduced. We 'could' just get rid of the REST login but at the very least not until https://bugzilla.mozilla.org/show_bug.cgi?id=1192538 is fixed.

Byron any other suggestions on this?

Comment 2

[:glob ✱]

you can pass the login and password in x-headers instead of the query-string.
it looks like this feature hasn't made it into the docs yet, sorry about that.

--8<--
Alternatively authentication credentials can be provided via one of the following X-Headers:
  X-BUGZILLA-LOGIN
  X-BUGZILLA-PASSWORD
  X-BUGZILLA-API-KEY
  X-BUGZILLA-TOKEN

Credentials passed as part of the query string take precedence over X-header credentials.
--8<--

Comment 3

[Dale Harvey (:daleharvey)]

Attachment: https://github.com/mozilla-b2g/bzlite/pull/39

Yo Byron, I know you arent familiar with the bzlite codebase, as I am owner I figured I can ask you for review, this switches us to using the headers and never sends the credentials via the url

Comment 4

[:glob ✱]

Comment on attachment 8649865 [details] [review]
https://github.com/mozilla-b2g/bzlite/pull/39

it looks like this patch only moves username/password credentials into the header.  api-key and token credentials should also be moved as they are equally sensitive.

Comment 5

[Dale Harvey (:daleharvey)]

Comment on attachment 8649865 [details] [review]
https://github.com/mozilla-b2g/bzlite/pull/39

Nice catch, I switched all the apikey / token usages to the headers over the url, thanks

Comment 6

[:glob ✱]

Comment on attachment 8649865 [details] [review]
https://github.com/mozilla-b2g/bzlite/pull/39

'X-API_KEY' should be 'X-API-KEY', but otherwise it looks good to me.
r=glob

Comment 7

[Dale Harvey (:daleharvey)]

Yeh we never actually use api-keys currently so missed that, but in there for completeness so cheers for catching again.

Fixed in https://github.com/mozilla-b2g/bzlite/commit/1f6f16165b218de7bce3c870802d0b8617f5eb53

Thanks