)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"8905045cf136e1b777f8246d2c4d938779de7767","unresolved":false,"context_lines":[{"line_number":10,"context_line":"does not need exist project and grant any actual authorization"},{"line_number":11,"context_line":"on it, This shouldn\u0027t be a warning."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"At the same time, if the log message exposes to the users,"},{"line_number":14,"context_line":"they know the identity authentication has already passed and"},{"line_number":15,"context_line":"the used password is valid, which could be useful to an attacker."},{"line_number":16,"context_line":"Log warnings is not necessarily as locked down as debug log,"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"3f1d235d_ac5b2c52","line":13,"range":{"start_line":13,"start_character":18,"end_line":13,"end_character":57},"updated":"2017-07-03 19:07:15.000000000","message":"If the users have access to your log messages, there is a much larger issue than knowing that their token is unscoped.","commit_id":"3fbdadafe7c32c019af422491175e8cbf9f0d12f"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"74c333ea119b6332c7c5f5ad32ae47580e203f93","unresolved":false,"context_lines":[{"line_number":10,"context_line":"does not need exist project and grant any actual authorization"},{"line_number":11,"context_line":"on it, This shouldn\u0027t be a warning."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"At the same time, if the log message exposes to the users,"},{"line_number":14,"context_line":"they know the identity authentication has already passed and"},{"line_number":15,"context_line":"the used password is valid, which could be useful to an attacker."},{"line_number":16,"context_line":"Log warnings is not necessarily as locked down as debug log,"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"3f1d235d_a9d5c5e7","line":13,"range":{"start_line":13,"start_character":18,"end_line":13,"end_character":57},"in_reply_to":"3f1d235d_0edb9f7d","updated":"2017-07-07 15:43:58.000000000","message":"Agreed","commit_id":"3fbdadafe7c32c019af422491175e8cbf9f0d12f"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"6a908e16d4e6ee56fccd1575719e5af50f63baf5","unresolved":false,"context_lines":[{"line_number":10,"context_line":"does not need exist project and grant any actual authorization"},{"line_number":11,"context_line":"on it, This shouldn\u0027t be a warning."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"At the same time, if the log message exposes to the users,"},{"line_number":14,"context_line":"they know the identity authentication has already passed and"},{"line_number":15,"context_line":"the used password is valid, which could be useful to an attacker."},{"line_number":16,"context_line":"Log warnings is not necessarily as locked down as debug log,"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"3f1d235d_0edb9f7d","line":13,"range":{"start_line":13,"start_character":18,"end_line":13,"end_character":57},"in_reply_to":"3f1d235d_ac5b2c52","updated":"2017-07-07 15:15:36.000000000","message":"The intent is still valid, logging sensitive information to disk runs the risk that the disk will be compromised, or transmitting logs to a log server runs the risk that it will be intercepted in transit, and it\u0027s generally recommended to not log sensitive information: https://wiki.openstack.org/wiki/Security/Guidelines/logging_guidelines","commit_id":"3fbdadafe7c32c019af422491175e8cbf9f0d12f"}],"keystone/auth/controllers.py":[{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"8905045cf136e1b777f8246d2c4d938779de7767","unresolved":false,"context_lines":[{"line_number":199,"context_line":"                           \" default project %(project_id)s. The token\""},{"line_number":200,"context_line":"                           \" will be unscoped rather than scoped to the\""},{"line_number":201,"context_line":"                           \" project.\")"},{"line_number":202,"context_line":"                    LOG.debug(msg,"},{"line_number":203,"context_line":"                              {\u0027user_id\u0027: user_ref[\u0027id\u0027],"},{"line_number":204,"context_line":"                               \u0027project_id\u0027: default_project_id})"},{"line_number":205,"context_line":"            else:"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f1d235d_0c47c07a","line":202,"range":{"start_line":202,"start_character":24,"end_line":202,"end_character":28},"updated":"2017-07-03 19:07:15.000000000","message":"I would say either keep this at warning or change to info. We would have to enable debugging for anyone to see these messages.","commit_id":"3fbdadafe7c32c019af422491175e8cbf9f0d12f"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"8905045cf136e1b777f8246d2c4d938779de7767","unresolved":false,"context_lines":[{"line_number":215,"context_line":"            msg \u003d (\"User %(user_id)s\u0027s default project %(project_id)s not\""},{"line_number":216,"context_line":"                   \" found. The token will be unscoped rather than\""},{"line_number":217,"context_line":"                   \" scoped to the project.\")"},{"line_number":218,"context_line":"            LOG.debug(msg, {\u0027user_id\u0027: user_ref[\u0027id\u0027],"},{"line_number":219,"context_line":"                            \u0027project_id\u0027: default_project_id})"},{"line_number":220,"context_line":""},{"line_number":221,"context_line":"    def authenticate(self, request, auth_info, auth_context):"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f1d235d_6c55141d","line":218,"range":{"start_line":218,"start_character":16,"end_line":218,"end_character":21},"updated":"2017-07-03 19:07:15.000000000","message":"If we are throwing exceptions, warning makes more sense.","commit_id":"3fbdadafe7c32c019af422491175e8cbf9f0d12f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ed8ad5b36b80731c399aba10c4d430b2d3a87048","unresolved":false,"context_lines":[{"line_number":215,"context_line":"            msg \u003d (\"User %(user_id)s\u0027s default project %(project_id)s not\""},{"line_number":216,"context_line":"                   \" found. The token will be unscoped rather than\""},{"line_number":217,"context_line":"                   \" scoped to the project.\")"},{"line_number":218,"context_line":"            LOG.debug(msg, {\u0027user_id\u0027: user_ref[\u0027id\u0027],"},{"line_number":219,"context_line":"                            \u0027project_id\u0027: default_project_id})"},{"line_number":220,"context_line":""},{"line_number":221,"context_line":"    def authenticate(self, request, auth_info, auth_context):"}],"source_content_type":"text/x-python","patch_set":3,"id":"1f1a1f67_6077a43c","line":218,"in_reply_to":"3f1d235d_6c55141d","updated":"2017-07-13 02:41:03.000000000","message":"This doesn\u0027t throw an exception though. The messages here are restricted to logs.\n\nHowever, there is a common pattern in keystone where the same message is used in the log and the Exception, which can be returned to the user. Decoupling these things is what Brant was eluding to in the bug report Colleen referenced.\n\nhttps://bugs.launchpad.net/keystone/+bug/1479523","commit_id":"3fbdadafe7c32c019af422491175e8cbf9f0d12f"}]}