XIV Storage Password exposed by PyXCLI after enabling debug logs

[abhinav1592]

Overview Description:

When we try to create a volume or create a consistency group and take a snapshot of it and debug logs are enabled, password is exposed for XIV storage in the logs.

Environment:

[root@jupiter-vm1595 ~]# cat /etc/os-release
NAME="Red Hat Enterprise Linux"
VERSION="8.2 (Ootpa)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="8.2"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Red Hat Enterprise Linux 8.2 (Ootpa)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:redhat:enterprise_linux:8.2:GA"
HOME_URL="https://www.redhat.com/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 8"
REDHAT_BUGZILLA_PRODUCT_VERSION=8.2
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="8.2"

PyXCLI version

[root@jupiter-vm1595 ~]# rpm -qa | grep pyxcli
python3-pyxcli-1.2.1-5.ibm.el8.noarch

Steps to Reproduce:
**

1. Enable debug=True in xiv's cinder driver's config file and restart cinder service.
2. Create a volume

OR

3. Create a consistency group and take a group snapshot of it.

Log files stack-trace:

2020-10-12 06:27:38.830 1872530 INFO cinder.volume.drivers.ibm.ibm_storage.xiv_proxy [req-576185ae-1904-43c5-a78e-eaa55292bdd6 0688b01e6439ca32d698d20789d52169126fb41fb1a4ddafcebb97d854e836c9 d3b0cf23e0f14c13af9a14ab16b09fd8 - default default] _call_xiv_xcli #1: cg_snapshots_create
2020-10-12 06:27:38.831 1872530 DEBUG xcli [*req-576185ae-1904-43c5-a78e-eaa55292bdd6 0688b01e4439ca32d698d20789d52169126fb41fb1a4ddafcebb97d854e836c9 d3b0cf23e0f14c12af9a14ab16b09fd8 - default default] SEND <command close_on_return="no" id="14467" type="cg_snapshots_create"><option name="i-am-sure" value="yes" /><option name="gui-mode" value="yes" /><option name="force-output" value="yes" /><option name="print-header" value="no" /><option name="compress-output" value="base64" />**<option name="user" value="rootadmin" /><option name="password" value="xyz4321" />***<argument name="cg" value="cg_4780eaf0-c2f7-492e-8a4c-3bdd7csbb642" /><argument name="snap_group" value="cgs_51592fbc-85db-4ca8-a699-bcfd84b5721a" /></command> _build_command /usr/lib/python3.6/site-packages/pyxcli/client.py:289

Expected Results:
Username and Password should not be exposed in log files. Password should have been 'XXX'

[abhinav1592]

This change-set fixes the problem:

        anon = None
        if("password" in options):
            data = data.decode()
            anon = data.replace(options["password"], "XXX")
            data.encode()
      else:
            anon = data