cloudstack/utils
Vijayendra Bhamidipati f1ec4fddd3 CS-15217: Security: Malicious user is able to get the size of the cloud by enumerating IDs
Description:

	As part of the fix for Bug CS-13127, a new overloaded function,
	addProxyObject() was added to facilitate transparent db id to
	uuid conversions when db IDs were added to exceptions that were
	thrown in the Cloudstack mgmt server code. However, it turns out
	that there are quite many db IDs still in the code that are
	being directly embedded in the String message that is passed
	during exception creation.

	In this commit, we modify the default constructor of
	InvalidParameterValueException so that it takes a second
	argument of type List<IdentityProxy>. This will help developers
	see that there is a second parameter required, and make them
	look into what that parameter is about. Hopefully, this will
	stop db IDs from being embedded into the exception message.

	The parameter can be set to null though, since there are many
	places in the code that don't embed any DB IDs in the exception.

	This is still a WIP, so the older default constructor for
	InvalidParameterValueException has not been removed yet. When
	all instances of throw new InvalidParameterValueException()
	have been moved over to the new default constructor, the old
	one will be removed, else compilation will break. The reason
	for having to do this in batches is that there are way too
	many places in the code that throw exceptions, and they all
	cannot be covered in a single commit without it taking much
	time.

	In following commits, all other exceptions will be changed
	in the same way as InvalidParameterValueException.
2012-07-05 16:48:36 -07:00
..
bindir If git build sccs file is present, catenate it to standard output with these brand new commands 2010-08-11 18:14:55 -07:00
certs Update fail-safe keystore with RSA private key 2011-07-25 18:55:16 -07:00
conf Fix error from merge 2012-04-30 17:08:36 -07:00
src CS-15217: Security: Malicious user is able to get the size of the cloud by enumerating IDs 2012-07-05 16:48:36 -07:00
test CS-6840: Add commands for site-to-site vpn 2012-06-27 19:05:41 -07:00
.classpath new log4j 2011-06-21 10:15:21 -07:00
.project Source code committed 2010-08-11 09:13:29 -07:00
LICENSE bug 9697: encode api response values 2011-06-10 18:10:44 -07:00