Uploaded image for project: 'Bitbucket Data Center'
  1. Bitbucket Data Center
  2. BSERV-13616

Private key is logged at DEBUG level when accidentally entered into SSH page

    XMLWordPrintable

Details

    Description

      When a user uploads their public SSH key, Bitbucket will log the submitted data at DEBUG level if the key is invalid. Unfortunately, if a user mistakenly uploads their private key, this will be logged:

      username *SECO1Qx158x13421x0 3omfyq 123.45.67.89,12.34.56.78 "POST /plugins/servlet/ssh/account/keys/add HTTP/1.1" c.a.bitbucket.ssh.util.KeyUtils Invalid key: [-----BEGIN RSA PRIVATE KEY-----
      [...]
      

      Given that many systems (including Atlassian's) run with debug logs enabled, we should not be logging this information.

      Attachments

        Issue Links

          Activity

            People

              bplump Brent P
              bplump Brent P
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: