Eclipse Community Forums: BIRT » BIRT reports security issue with database password (odaPassword)

Home » Archived » BIRT » BIRT reports security issue with database password (odaPassword)(Database Password (odaPassword) unencrypted)

BIRT reports security issue with database password (odaPassword) [message #777901]

Wed, 11 January 2012 01:06

Eclipse User

Hello,

I have remarked that my database password appear not-encrypted into the report file under the design section.

<design:DataSetParameters>
<design:parameterDefinitions>
<design:inOutMode>In</design:inOutMode>
<design:attributes>
...
</design:attributes>
<design:inputAttributes>
<design:elementAttributes>
<design:optional>false</design:optional>
<design:masksValue>false</design:masksValue>
<design:dynamicValueChoices>
<design:dataSetDesign>
<design:name>Agents</design:name>
<design:odaExtensionDataSetId>org.eclipse.birt.report.data.oda.jdbc.JdbcSelectDataSet</design:odaExtensionDataSetId>
<design:dataSourceDesign>
<design:name>vsl</design:name>
<design:odaExtensionId>org.eclipse.birt.report.data.oda.jdbc</design:odaExtensionId>
<design:publicProperties>
<design:properties>
<design:nameValue>
<design:name>odaDriverClass</design:name>
<design:value>org.postgresql.Driver</design:value>
</design:nameValue>
</design:properties>
<design:properties>
<design:nameValue>
<design:name>odaURL</design:name>
<design:value>jdbc:postgresql://localhost/db</design:value>
</design:nameValue>
</design:properties>
<design:properties>
<design:nameValue>
<design:name>odaUser</design:name>
<design:value>postgres</design:value>
</design:nameValue>
</design:properties>
<design:properties>
<design:nameValue>
<design:name>odaPassword</design:name>
<design:value>CLEAR_PASSWORD</design:value>
</design:nameValue>

-The value of the parameter odaPassword is not encrypted!

Just to note that the database password is encrypted for the data-source definition :
<property name="odaDriverClass">org.postgresql.Driver</property>
<property name="odaURL">jdbc:postgresql://localhost/db</property>
<property name="odaUser">postgres</property>
<encrypted-property name="odaPassword" encryptionID="base64">ENCRYPTED_PASSWORD</encrypted-property>

Any help is very appreciated.
Thanks in advance.

Cheers

PS: I'm using BIRT 2.5.2

Re: BIRT reports security issue with database password (odaPassword) [message #778401 is a reply to message #777901]

Wed, 11 January 2012 12:38

Eclipse User

I believe in later versions this has been fixed. If you switch to the
xml view and delete the designer values, does it re-write them?

Jason

On 1/11/2012 1:06 AM, Daniel Mising name wrote:
> Hello,
>
> I have remarked that my database password appear not-encrypted into the
> report file under the design section.
>
> <design:DataSetParameters>
> <design:parameterDefinitions>
> <design:inOutMode>In</design:inOutMode>
> <design:attributes>
> ...
> </design:attributes>
> <design:inputAttributes>
> <design:elementAttributes>
> <design:optional>false</design:optional>
> <design:masksValue>false</design:masksValue>
> <design:dynamicValueChoices>
> <design:dataSetDesign>
> <design:name>Agents</design:name>
> <design:odaExtensionDataSetId>org.eclipse.birt.report.data.oda.jdbc.JdbcSelectDataSet</design:odaExtensionDataSetId>
>
> <design:dataSourceDesign>
> <design:name>vsl</design:name>
> <design:odaExtensionId>org.eclipse.birt.report.data.oda.jdbc</design:odaExtensionId>
>
> <design:publicProperties>
> <design:properties>
> <design:nameValue>
> <design:name>odaDriverClass</design:name>
> <design:value>org.postgresql.Driver</design:value>
> </design:nameValue>
> </design:properties>
> <design:properties>
> <design:nameValue>
> <design:name>odaURL</design:name>
> <design:value>jdbc:postgresql://localhost/db</design:value>
> </design:nameValue>
> </design:properties>
> <design:properties>
> <design:nameValue>
> <design:name>odaUser</design:name>
> <design:value>postgres</design:value>
> </design:nameValue>
> </design:properties>
> <design:properties>
> <design:nameValue>
> <design:name>odaPassword</design:name>
> <design:value>CLEAR_PASSWORD</design:value>
> </design:nameValue>
>
>
> -The value of the parameter odaPassword is not encrypted!
>
> Just to note that the database password is encrypted for the data-source
> definition :
> <property name="odaDriverClass">org.postgresql.Driver</property>
> <property name="odaURL">jdbc:postgresql://localhost/db</property>
> <property name="odaUser">postgres</property>
> <encrypted-property name="odaPassword"
> encryptionID="base64">ENCRYPTED_PASSWORD</encrypted-property>
>
>
> Any help is very appreciated.
> Thanks in advance.
>
> Cheers
> PS: I'm using BIRT 2.5.2

Re: BIRT reports security issue with database password (odaPassword) [message #781054 is a reply to message #778401]

Fri, 20 January 2012 03:56

Eclipse User

Hi Jason,

Thanks a lot Smile

I have only deleted the design value for the odaPassword parameter as you have suggested, so now it looks like this :

<design:name>odaPassword</design:name>
<design:value></design:value>

and the problem is SOLVED, the report still works as expected and the database password is not shown.

I have edited the .rptdesign file manually (with text editor) but even I have re-saved the report with the BIRT designer the password was not re-written.

Cheers

[Updated on: Fri, 20 January 2012 04:34] by Moderator

Previous Topic:	Sum Elements in Grid
Next Topic:	"Getting more records or rows with data which are not generated in Birt designer preview."

Goto Forum:

-=] Back to Top [=-

Current Time: Wed Jul 23 13:57:02 EDT 2025

.:: Contact :: Home ::.

Breadcrumbs

Sign up to our Newsletter