In previous releases of JBoss EAP 6, the `SensitiveVaultExpressionConstraint` class was using an incorrect string index when multiple {} occurred in the write attribute value.
As a result, the use of the incorrect index was causing a `StringIndexOutOfBoundsException` to present.
In this release the `isSensitiveValue` method of the `SensitiveVaultExpressionConstraint` class is fixed to use the correct index and the `StringIndexOutOfBoundsException` no longer prensents.
Description of problem:
======================
The isSensitiveValue(ModelNode value) method of class "org.jboss.as.controller.access.constraint.SensitiveVaultExpressionConstraint" seems to be using the incorrect index in java.lang.String.substring method. Which is causing the following exceptions in the logs while executing the following kind of CLI command:
+++++++++++
[standalone@localhost:9999 /] /subsystem=logging/periodic-rotating-file-handler=FILE:write-attribute(name=formatter, value="%d{HH:mm:ss,SSS} %-5p [%c] (${jboss.node.name} %t) %s%E%n")
{
"outcome" => "failed",
"failure-description" => "JBAS014749: Operation handler failed: String index out of range: -15",
"rolled-back" => true
}
+++++++++++
The Exception can be seen as following in the WildFly Logs:
+++++++++++
22:08:07,640 ERROR [org.jboss.as.controller.management-operation] (management-handler-thread - 4) JBAS014612: Operation ("write-attribute") failed - address: ([
("subsystem" => "logging"),
("periodic-rotating-file-handler" => "FILE")
]): java.lang.StringIndexOutOfBoundsException: String index out of range: -15
at java.lang.String.substring(String.java:1911) [rt.jar:1.7.0_51]
at org.jboss.as.controller.access.constraint.SensitiveVaultExpressionConstraint$Factory.isSensitiveValue(SensitiveVaultExpressionConstraint.java:128) [jboss-as-controller-7.3.0.Final-redhat-14.jar:7.3.0.Final-redhat-14]
at org.jboss.as.controller.access.constraint.SensitiveVaultExpressionConstraint$Factory.isSensitiveAction(SensitiveVaultExpressionConstraint.java:89) [jboss-as-controller-7.3.0.Final-redhat-14.jar:7.3.0.Final-redhat-14]
at org.jboss.as.controller.access.constraint.SensitiveVaultExpressionConstraint$Factory.getRequiredConstraint(SensitiveVaultExpressionConstraint.java:81) [jboss-as-controller-7.3.0.Final-redhat-14.jar:7.3.0.Final-redhat-14]
at org.jboss.as.controller.access.rbac.DefaultPermissionFactory.getRequiredPermissions(DefaultPermissionFactory.java:201) [jboss-as-controller-7.3.0.Final-redhat-14.jar:7.3.0.Final-redhat-14]
+++++++++++
Version-Release number of selected component (if applicable):
How reproducible:
==================
Steps to Reproduce:
1. Take a fresh EAP 6.2 installation.
2. Start the Standalone profile.
3. Now using the "jboss-cli.sh" script run the following command:
/subsystem=logging/periodic-rotating-file-handler=FILE:write-attribute(name=formatter, value="%d{HH:mm:ss,SSS} %-5p [%c] (${jboss.node.name} %t) %s%E%n")
Actual results:
================
JBoss EAP throwing the following Error:
java.lang.StringIndexOutOfBoundsException: String index out of range: -15
at java.lang.String.substring(String.java:1911) [rt.jar:1.7.0_51]
at org.jboss.as.controller.access.constraint.SensitiveVaultExpressionConstraint$Factory.isSensitiveValue(SensitiveVaultExpressionConstraint.java:128) [jboss-as-controller-7.3.0.Final-redhat-14.jar:7.3.0.Final-redhat-14]
Expected results:
=================
Should have updated the logging configuration without throwing the exception.
Additional info:
Description of problem: ====================== The isSensitiveValue(ModelNode value) method of class "org.jboss.as.controller.access.constraint.SensitiveVaultExpressionConstraint" seems to be using the incorrect index in java.lang.String.substring method. Which is causing the following exceptions in the logs while executing the following kind of CLI command: +++++++++++ [standalone@localhost:9999 /] /subsystem=logging/periodic-rotating-file-handler=FILE:write-attribute(name=formatter, value="%d{HH:mm:ss,SSS} %-5p [%c] (${jboss.node.name} %t) %s%E%n") { "outcome" => "failed", "failure-description" => "JBAS014749: Operation handler failed: String index out of range: -15", "rolled-back" => true } +++++++++++ The Exception can be seen as following in the WildFly Logs: +++++++++++ 22:08:07,640 ERROR [org.jboss.as.controller.management-operation] (management-handler-thread - 4) JBAS014612: Operation ("write-attribute") failed - address: ([ ("subsystem" => "logging"), ("periodic-rotating-file-handler" => "FILE") ]): java.lang.StringIndexOutOfBoundsException: String index out of range: -15 at java.lang.String.substring(String.java:1911) [rt.jar:1.7.0_51] at org.jboss.as.controller.access.constraint.SensitiveVaultExpressionConstraint$Factory.isSensitiveValue(SensitiveVaultExpressionConstraint.java:128) [jboss-as-controller-7.3.0.Final-redhat-14.jar:7.3.0.Final-redhat-14] at org.jboss.as.controller.access.constraint.SensitiveVaultExpressionConstraint$Factory.isSensitiveAction(SensitiveVaultExpressionConstraint.java:89) [jboss-as-controller-7.3.0.Final-redhat-14.jar:7.3.0.Final-redhat-14] at org.jboss.as.controller.access.constraint.SensitiveVaultExpressionConstraint$Factory.getRequiredConstraint(SensitiveVaultExpressionConstraint.java:81) [jboss-as-controller-7.3.0.Final-redhat-14.jar:7.3.0.Final-redhat-14] at org.jboss.as.controller.access.rbac.DefaultPermissionFactory.getRequiredPermissions(DefaultPermissionFactory.java:201) [jboss-as-controller-7.3.0.Final-redhat-14.jar:7.3.0.Final-redhat-14] +++++++++++ Version-Release number of selected component (if applicable): How reproducible: ================== Steps to Reproduce: 1. Take a fresh EAP 6.2 installation. 2. Start the Standalone profile. 3. Now using the "jboss-cli.sh" script run the following command: /subsystem=logging/periodic-rotating-file-handler=FILE:write-attribute(name=formatter, value="%d{HH:mm:ss,SSS} %-5p [%c] (${jboss.node.name} %t) %s%E%n") Actual results: ================ JBoss EAP throwing the following Error: java.lang.StringIndexOutOfBoundsException: String index out of range: -15 at java.lang.String.substring(String.java:1911) [rt.jar:1.7.0_51] at org.jboss.as.controller.access.constraint.SensitiveVaultExpressionConstraint$Factory.isSensitiveValue(SensitiveVaultExpressionConstraint.java:128) [jboss-as-controller-7.3.0.Final-redhat-14.jar:7.3.0.Final-redhat-14] Expected results: ================= Should have updated the logging configuration without throwing the exception. Additional info: