From 98677c5bc8a95879976a793b3a3deb39bfa450e8 Mon Sep 17 00:00:00 2001
From: "jianghang.loujh" <[email protected]>
Date: Wed, 8 Nov 2023 10:58:43 +0800
Subject: [PATCH] fixed issue #4941 , remove default passwd

---
 .../otter/canal/admin/config/EbeanConfig.java  |  1 +
 .../otter/canal/admin/config/WebConfig.java    | 18 ++++++++++++++++++
 .../controller/PollingConfigController.java    | 10 +++-------
 .../src/main/resources/application.yml         |  2 +-
 .../otter/canal/deployer/CanalController.java  | 10 ++++++++--
 .../otter/canal/deployer/CanalLauncher.java    |  4 ++++
 .../otter/canal/deployer/CanalStarter.java     |  1 -
 deployer/src/main/resources/canal.properties   |  4 ++--
 8 files changed, 37 insertions(+), 13 deletions(-)

diff --git a/admin/admin-web/src/main/java/com/alibaba/otter/canal/admin/config/EbeanConfig.java b/admin/admin-web/src/main/java/com/alibaba/otter/canal/admin/config/EbeanConfig.java
index aae0f56656..a7ae5ae8ef 100644
--- a/admin/admin-web/src/main/java/com/alibaba/otter/canal/admin/config/EbeanConfig.java
+++ b/admin/admin-web/src/main/java/com/alibaba/otter/canal/admin/config/EbeanConfig.java
@@ -10,6 +10,7 @@
 
 import javax.sql.DataSource;
 
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 
diff --git a/admin/admin-web/src/main/java/com/alibaba/otter/canal/admin/config/WebConfig.java b/admin/admin-web/src/main/java/com/alibaba/otter/canal/admin/config/WebConfig.java
index 6130591ecd..ff2b06c248 100644
--- a/admin/admin-web/src/main/java/com/alibaba/otter/canal/admin/config/WebConfig.java
+++ b/admin/admin-web/src/main/java/com/alibaba/otter/canal/admin/config/WebConfig.java
@@ -5,6 +5,8 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.apache.commons.lang.StringUtils;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
 import org.springframework.http.HttpStatus;
@@ -26,8 +28,24 @@
 @Configuration
 public class WebConfig implements WebMvcConfigurer {
 
+    @Value(value = "${canal.adminUser}")
+    private String user;
+
+    @Value(value = "${canal.adminPasswd}")
+    private String passwd;
+
     @Override
     public void addInterceptors(InterceptorRegistry registry) {
+        if (StringUtils.isEmpty(user)) {
+            throw new IllegalArgumentException(
+                "canal.adminUser is empty , pls check https://github.com/alibaba/canal/issues/4941");
+        }
+
+        if (StringUtils.isEmpty(passwd)) {
+            throw new IllegalArgumentException(
+                "canal.adminPasswd is empty , pls check https://github.com/alibaba/canal/issues/4941");
+        }
+
         registry.addInterceptor(new HandlerInterceptor() {
 
             @Override
diff --git a/admin/admin-web/src/main/java/com/alibaba/otter/canal/admin/controller/PollingConfigController.java b/admin/admin-web/src/main/java/com/alibaba/otter/canal/admin/controller/PollingConfigController.java
index 01b8f1aba8..a007053dec 100644
--- a/admin/admin-web/src/main/java/com/alibaba/otter/canal/admin/controller/PollingConfigController.java
+++ b/admin/admin-web/src/main/java/com/alibaba/otter/canal/admin/controller/PollingConfigController.java
@@ -2,15 +2,11 @@
 
 import java.security.NoSuchAlgorithmException;
 
+import org.apache.commons.lang.RandomStringUtils;
 import org.apache.commons.lang.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.RequestHeader;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.bind.annotation.*;
 
 import com.alibaba.otter.canal.admin.model.BaseModel;
 import com.alibaba.otter.canal.admin.model.CanalConfig;
@@ -28,7 +24,7 @@
 @RequestMapping("/api/{env}/config")
 public class PollingConfigController {
 
-    private static final byte[] seeds = "canal is best!".getBytes();
+    private static final byte[] seeds = RandomStringUtils.random(16).getBytes();
 
     @Value(value = "${canal.adminUser}")
     String                      user;
diff --git a/admin/admin-web/src/main/resources/application.yml b/admin/admin-web/src/main/resources/application.yml
index a4f3fc30d1..b8b1e9fc20 100644
--- a/admin/admin-web/src/main/resources/application.yml
+++ b/admin/admin-web/src/main/resources/application.yml
@@ -18,4 +18,4 @@ spring.datasource:
 
 canal:
   adminUser: admin
-  adminPasswd: admin
\ No newline at end of file
+  adminPasswd:
diff --git a/deployer/src/main/java/com/alibaba/otter/canal/deployer/CanalController.java b/deployer/src/main/java/com/alibaba/otter/canal/deployer/CanalController.java
index e534763372..0bbc2bc0ac 100644
--- a/deployer/src/main/java/com/alibaba/otter/canal/deployer/CanalController.java
+++ b/deployer/src/main/java/com/alibaba/otter/canal/deployer/CanalController.java
@@ -117,8 +117,14 @@ public CanalController(final Properties properties){
 
         this.adminUser = getProperty(properties, CanalConstants.CANAL_ADMIN_USER);
         this.adminPasswd = getProperty(properties, CanalConstants.CANAL_ADMIN_PASSWD);
-        embeddedCanalServer.setUser(getProperty(properties, CanalConstants.CANAL_USER));
-        embeddedCanalServer.setPasswd(getProperty(properties, CanalConstants.CANAL_PASSWD));
+        String user = getProperty(properties, CanalConstants.CANAL_USER);
+        String passwd = getProperty(properties, CanalConstants.CANAL_PASSWD);
+        if (StringUtils.isNotEmpty(user) && StringUtils.isEmpty(passwd)) {
+            throw new IllegalArgumentException(
+                "canal.user = " + user + " , but canal.passwd is empty , pls check https://github.com/alibaba/canal/issues/4941");
+        }
+        embeddedCanalServer.setUser(user);
+        embeddedCanalServer.setPasswd(passwd);
 
         String canalWithoutNetty = getProperty(properties, CanalConstants.CANAL_WITHOUT_NETTY);
         if (canalWithoutNetty == null || "false".equals(canalWithoutNetty)) {
diff --git a/deployer/src/main/java/com/alibaba/otter/canal/deployer/CanalLauncher.java b/deployer/src/main/java/com/alibaba/otter/canal/deployer/CanalLauncher.java
index 11f4f5c7d3..36d8768369 100644
--- a/deployer/src/main/java/com/alibaba/otter/canal/deployer/CanalLauncher.java
+++ b/deployer/src/main/java/com/alibaba/otter/canal/deployer/CanalLauncher.java
@@ -54,6 +54,10 @@ public static void main(String[] args) {
             if (StringUtils.isNotEmpty(managerAddress)) {
                 String user = CanalController.getProperty(properties, CanalConstants.CANAL_ADMIN_USER);
                 String passwd = CanalController.getProperty(properties, CanalConstants.CANAL_ADMIN_PASSWD);
+                if (StringUtils.isEmpty(passwd)) {
+                    throw new IllegalArgumentException(
+                        "canal.admin.passwd is empty , pls check https://github.com/alibaba/canal/issues/4941");
+                }
                 String adminPort = CanalController.getProperty(properties, CanalConstants.CANAL_ADMIN_PORT, "11110");
                 boolean autoRegister = BooleanUtils.toBoolean(CanalController.getProperty(properties,
                     CanalConstants.CANAL_ADMIN_AUTO_REGISTER));
diff --git a/deployer/src/main/java/com/alibaba/otter/canal/deployer/CanalStarter.java b/deployer/src/main/java/com/alibaba/otter/canal/deployer/CanalStarter.java
index 4f56234791..5108c0d3b6 100644
--- a/deployer/src/main/java/com/alibaba/otter/canal/deployer/CanalStarter.java
+++ b/deployer/src/main/java/com/alibaba/otter/canal/deployer/CanalStarter.java
@@ -115,7 +115,6 @@ public synchronized void start() throws Throwable {
             CanalAdminController canalAdmin = new CanalAdminController(this);
             canalAdmin.setUser(user);
             canalAdmin.setPasswd(passwd);
-
             String ip = CanalController.getProperty(properties, CanalConstants.CANAL_IP);
 
             logger.debug("canal admin port:{}, canal admin user:{}, canal admin password: {}, canal ip:{}",
diff --git a/deployer/src/main/resources/canal.properties b/deployer/src/main/resources/canal.properties
index 2586a60ae9..414a473e08 100644
--- a/deployer/src/main/resources/canal.properties
+++ b/deployer/src/main/resources/canal.properties
@@ -9,13 +9,13 @@ canal.port = 11111
 canal.metrics.pull.port = 11112
 # canal instance user/passwd
 # canal.user = canal
-# canal.passwd = E3619321C1A937C46A0D8BD1DAC39F93B27D4458
+# canal.passwd =
 
 # canal admin config
 #canal.admin.manager = 127.0.0.1:8089
 canal.admin.port = 11110
 canal.admin.user = admin
-canal.admin.passwd = 4ACFE3202A5FF5CF467898FC58AAB1D615029441
+canal.admin.passwd =
 # admin auto register
 #canal.admin.register.auto = true
 #canal.admin.register.cluster =