LinkedIn
Twitter
Hi,
I'm adding to the organization level a mask for passwords. The xml looks like this:
<MaskDataConfiguration name="default">
<JSONPathsRequest>
<JSONPathRequest>$..password.</JSONPathRequest>
<JSONPathRequest>$..oldPassword.</JSONPathRequest>
<JSONPathRequest>$..newPassword.</JSONPathRequest>
</JSONPathsRequest>
<JSONPathsResponse>
<JSONPathResponse>$..password.</JSONPathResponse>
<JSONPathResponse>$..oldPassword.</JSONPathResponse>
<JSONPathResponse>$..newPassword.</JSONPathResponse>
</JSONPathsResponse>
<Variables>
<Variable>ServiceCallout.request</Variable>
<Variable>request.formparam.password</Variable>
</Variables>
</MaskDataConfiguration>
Using that description for the mask I noticed that if you have a json request that looks like this
{ "email": "user@abc.com", "password": "password"}
on the Edge I see this
{ "email": "user@abc.com", "**********":"**********"}which is quite easy to infer the password 🙂
So, is that an expected behavior on the Edge or is it a bug?
Thanks,
Matias
@Matias It might appear that there's a correlation between the actual and the masked characters in terms of the total number of characters and what the actual content could be, but that's not true. You can try with a very long string and it would still mask it the same way.
But I do see your point about the key getting masked, which can act as some sort of indication of what the value could be. This is a known bug, that we are already aware of and should get fixed in some future release. Here's a sample request, where the masking happens differently:
curl -v http://myapis.apigee.net/masking -d '{ "email": "user@abc.com", "password": "unknownpasswordstring"}' -H "content-type: application/json"
@Matias I would also like to confirm, if you are a trying this on cloud or on-premises. If I remember correctly, this bug was fixed on our cloud release somewhere in October and I see its working fine. If you are on some version of OPDK, you might need a patch for this fix. If you can share more details about your test environment, it would be great.
