nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Security issue

daniel_v

Hello, 
 
I have remarked that my database password appear not-encrypted into the report file under the design section. 
 
<design:DataSetParameters> 
<design:parameterDefinitions> 
<design:inOutMode>In</design:inOutMode> 
<design:attributes> 
... 
</design:attributes> 
<design:inputAttributes> 
<design:elementAttributes> 
<design:optional>false</design:optional> 
<design:masksValue>false</design:masksValue> 
<design:dynamicValueChoices> 
<design:dataSetDesign> 
<design:name>Agents</design:name> 
<design:odaExtensionDataSetId>org.eclipse.birt.report.data.oda.jdbc.JdbcSelectDataSet</design:odaExtensionDataSetId> 
<design:dataSourceDesign> 
<design:name>vsl</design:name> 
<design:odaExtensionId>org.eclipse.birt.report.data.oda.jdbc</design:odaExtensionId> 
<design:publicProperties> 
<design:properties> 
<design:nameValue> 
<design:name>odaDriverClass</design:name> 
<design:value>org.postgresql.Driver</design:value> 
</design:nameValue> 
</design:properties> 
<design:properties> 
<design:nameValue> 
<design:name>odaURL</design:name> 
<design:value>jdbc:postgresql://localhost/db</design:value> 
</design:nameValue> 
</design:properties> 
<design:properties> 
<design:nameValue> 
<design:name>odaUser</design:name> 
<design:value>postgres</design:value> 
</design:nameValue> 
</design:properties> 
<design:properties> 
<design:nameValue> 
<design:name>odaPassword</design:name> 
<design:value>CLEAR_PASSWORD</design:value> 
</design:nameValue> 
 
 
-The value of the parameter odaPassword is not encrypted! 
 
Just to note that the database password is encrypted for the data-source definition : 
<property name="odaDriverClass">org.postgresql.Driver</property> 
<property name="odaURL">jdbc:postgresql://localhost/db</property> 
<property name="odaUser">postgres</property> 
<encrypted-property name="odaPassword" encryptionID="base64">ENCRYPTED_PASSWORD</encrypted-property> 
 
 
Any help is very appreciated. 
Thanks in advance. 
 
Cheers

Find more posts tagged with

Comments

daniel_v

Hi, 
 
Thanks to Jason W. this question has been answered <a class='bbc_url' href='http://www.eclipse.org/forums/index.php/mv/msg/275607/777901/#msg_777901'>HERE (at the eclipse.org forum)</a> : 
 
Just removing the design value, so it looks like : 
<design:name>odaPassword</design:name> 
<design:value></design:value> 
 
and the problem is solved, the report still works as expected and the DB password is not shown

<blockquote class='ipsBlockquote' data-author="'daniel_v'" data-cid="93791" data-time="1326092944" data-date="09 January 2012 - 12:09 AM">
Hello, 
 
I have remarked that my database password appear not-encrypted into the report file under the design section. 
 
<design:DataSetParameters> 
<design:parameterDefinitions> 
<design:inOutMode>In</design:inOutMode> 
<design:attributes> 
... 
</design:attributes> 
<design:inputAttributes> 
<design:elementAttributes> 
<design:optional>false</design:optional> 
<design:masksValue>false</design:masksValue> 
<design:dynamicValueChoices> 
<design:dataSetDesign> 
<design:name>Agents</design:name> 
<design:odaExtensionDataSetId>org.eclipse.birt.report.data.oda.jdbc.JdbcSelectDataSet</design:odaExtensionDataSetId> 
<design:dataSourceDesign> 
<design:name>vsl</design:name> 
<design:odaExtensionId>org.eclipse.birt.report.data.oda.jdbc</design:odaExtensionId> 
<design:publicProperties> 
<design:properties> 
<design:nameValue> 
<design:name>odaDriverClass</design:name> 
<design:value>org.postgresql.Driver</design:value> 
</design:nameValue> 
</design:properties> 
<design:properties> 
<design:nameValue> 
<design:name>odaURL</design:name> 
<design:value>jdbc:postgresql://localhost/db</design:value> 
</design:nameValue> 
</design:properties> 
<design:properties> 
<design:nameValue> 
<design:name>odaUser</design:name> 
<design:value>postgres</design:value> 
</design:nameValue> 
</design:properties> 
<design:properties> 
<design:nameValue> 
<design:name>odaPassword</design:name> 
<design:value>CLEAR_PASSWORD</design:value> 
</design:nameValue> 
 
 
-The value of the parameter odaPassword is not encrypted! 
 
Just to note that the database password is encrypted for the data-source definition : 
<property name="odaDriverClass">org.postgresql.Driver</property> 
<property name="odaURL">jdbc:postgresql://localhost/db</property> 
<property name="odaUser">postgres</property> 
<encrypted-property name="odaPassword" encryptionID="base64">ENCRYPTED_PASSWORD</encrypted-property> 
 
 
Any help is very appreciated. 
Thanks in advance. 
 
Cheers </blockquote>