Mask vncPasswd being logged in agent.log #12404

sudo87 · 2026-01-12T08:59:29Z

Description

This PR fixes #10847

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

codecov · 2026-01-12T09:07:12Z

Codecov Report

❌ Patch coverage is 30.76923% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 16.23%. Comparing base (0e6d2d9) to head (b5588fa).
⚠️ Report is 3 commits behind head on 4.20.

Files with missing lines	Patch %	Lines
...resource/wrapper/LibvirtMigrateCommandWrapper.java	36.36%	6 Missing and 1 partial ⚠️
...m/resource/wrapper/LibvirtStartCommandWrapper.java	0.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##              4.20   #12404       +/-   ##
============================================
+ Coverage     4.00%   16.23%   +12.23%     
- Complexity       0    13379    +13379     
============================================
  Files          402     5657     +5255     
  Lines        32688   498955   +466267     
  Branches      5822    60557    +54735     
============================================
+ Hits          1309    81023    +79714     
- Misses       31224   408896   +377672     
- Partials       155     9036     +8881

Flag	Coverage Δ
uitests	`4.00% <ø> (ø)`
unittests	`17.09% <30.76%> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

weizhouapache

code lgtm

abh1sar

LGTM

abh1sar · 2026-01-12T09:35:48Z

@blueorangutan package

blueorangutan · 2026-01-12T09:38:05Z

@abh1sar a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

DaanHoogland · 2026-01-12T10:17:06Z

...vm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtMigrateCommandWrapper.java

            if (logger.isDebugEnabled()) {
-                logger.debug(String.format("VM [%s] with XML configuration [%s] will be migrated to host [%s].", vmName, xmlDesc, target));
+                logger.debug("VM {} with XML configuration {} will be migrated to host {}.", vmName, maskSensitiveInfoInXML(xmlDesc), target);
            }


Suggested change

if (logger.isDebugEnabled()) {

logger.debug(String.format("VM [%s] with XML configuration [%s] will be migrated to host [%s].", vmName, xmlDesc, target));

logger.debug("VM {} with XML configuration {} will be migrated to host {}.", vmName, maskSensitiveInfoInXML(xmlDesc), target);

}

logger.debug("VM {} with XML configuration {} will be migrated to host {}.", vmName, () -> maskSensitiveInfoInXML(xmlDesc), target);

just a suggestion, (may apply below as well)

DaanHoogland

clgtm, the isDebugEnabled are not strictly needed anymore.

DaanHoogland · 2026-01-12T10:19:29Z

...vm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtMigrateCommandWrapper.java

+    public static String maskSensitiveInfoInXML(String xmlDesc) {
+        if (xmlDesc == null) return null;
+        // Mask VNC password in XML for logging
+        return xmlDesc.replaceAll("(graphics\\s+[^>]*type=['\"]vnc['\"][^>]*passwd=['\"])([^'\"]*)(['\"])",


we can also just remove it, btw

blueorangutan · 2026-01-12T10:49:59Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16334

abh1sar · 2026-01-12T10:59:36Z

@blueorangutan test

blueorangutan · 2026-01-12T11:00:04Z

@abh1sar a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

sudo87 · 2026-01-12T11:20:45Z

Thanks @DaanHoogland for your review and suggestions. Let me know if my response makes sense:

Per argument lambda is not supported, it will perform toString instead of evaluation. It wont work the way we expect:

logger.debug("VM {} with XML configuration {} will be migrated to host {}.", vmName, () -> maskSensitiveInfoInXML(xmlDesc), target);

logger.isDebugEnabled check is added to avoid maskSensitiveInfoInXML invocation. Which is not expensive operation but not required if debug is not enabled. We can definitely remove it.

DaanHoogland · 2026-01-12T12:26:55Z

Per argument lambda is not supported, it will perform toString instead of evaluation. It wont work the way we expect:
logger.debug("VM {} with XML configuration {} will be migrated to host {}.", vmName, () -> maskSensitiveInfoInXML(xmlDesc), target);

this is not how I read the documentation, but I haven’t tested it. it should lazily evaluate the lambda ony if debug is enabled.

logger.isDebugEnabled check is added to avoid maskSensitiveInfoInXML invocation. Which is not expensive operation but not required if debug is not enabled. We can definitely remove it.

I do not care if point 1 is out of the way. It is just cleaner code. If you are right about point 1 we have a bigger issue.

I do not think either should stop this PR, but in general my experience is that follow-ups don’t happen,...

Mask vncPasswd being logged in agent.log

b5588fa

boring-cyborg bot added the component:kvm label Jan 12, 2026

sudo87 requested review from DaanHoogland and weizhouapache January 12, 2026 08:59

weizhouapache approved these changes Jan 12, 2026

View reviewed changes

abh1sar added this to the 4.20.3 milestone Jan 12, 2026

abh1sar approved these changes Jan 12, 2026

View reviewed changes

DaanHoogland reviewed Jan 12, 2026

View reviewed changes

DaanHoogland approved these changes Jan 12, 2026

View reviewed changes

DaanHoogland reviewed Jan 12, 2026

View reviewed changes

DaanHoogland added the status:needs-testing label Jan 12, 2026

Mask vncPasswd being logged in agent.log #12404

Are you sure you want to change the base?

Mask vncPasswd being logged in agent.log #12404

Conversation

sudo87 commented Jan 12, 2026

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

codecov bot commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

weizhouapache left a comment

Choose a reason for hiding this comment

Uh oh!

abh1sar left a comment

Choose a reason for hiding this comment

Uh oh!

abh1sar commented Jan 12, 2026

Uh oh!

blueorangutan commented Jan 12, 2026

Uh oh!

DaanHoogland Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

DaanHoogland Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

blueorangutan commented Jan 12, 2026

Uh oh!

abh1sar commented Jan 12, 2026

Uh oh!

blueorangutan commented Jan 12, 2026

Uh oh!

sudo87 commented Jan 12, 2026

Uh oh!

DaanHoogland commented Jan 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

codecov bot commented Jan 12, 2026 •

edited

Loading