Skip to content

[BUG] CSRF token parameter logged in OpenAllModules servlet #972

Closed

Description

@ismisepaul

Discovered during #918.

src/main/java/servlets/admin/moduleManagement/OpenAllModules.java logs the submitted CSRF token on every request, before the admin session is validated:

Object tokenParmeter = request.getParameter("csrfToken");
log.debug("Token Param: " + tokenParmeter.toString());

log4j2.properties sets the servlets logger to debug and sends it to the rolling log file, so this runs by default and puts valid admin CSRF tokens in the log.

It also throws a NullPointerException when the csrfToken parameter is missing, because .toString() is called on null.

Fix: remove the line, or log only whether the parameter was present.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions