[DaanHoogland]

Async APIs that take userdata stored it in async_job.job_cmd_info as plain base64, along with the other request parameters. Cloud-init often contains passwords, so anyone with DB read access could recover them. The same parameters were also published unmasked on the event bus as cmdInfo of async job events.

This PR reuses the existing AsyncJobDataHelper encryption by setting requestHasSensitiveInfo = true on the async APIs that accept userdata:

• deployVirtualMachine, deployVnfAppliance, createVMFromBackup (user and admin versions)
• createAutoScaleVmProfile, updateAutoScaleVmProfile

This also encrypts the deploy password parameter, which is stored in the same column.

Supporting changes:

• AsyncJobDaoImpl.countPendingJobs used SQL LIKE on job_cmd_info, which cannot match encrypted rows. It now filters pending jobs on the decrypted value. Without this, the pending backup job check would stop working for createVMFromBackup.
• ApiServer: userdata is added to the existing sensitiveFields set. That set is now applied through a single isSensitiveField() helper to both the request trace log and the cmdInfo of published async job events.
  Note: event consumers now see ****** for every field the set matches, and a password value is fully masked instead of showing its first character.

Fixes: #14530

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• Build/CI
• Test (unit or integration test code)

Bug Severity

• BLOCKER
• Critical
• Major
• Minor
• Trivial

How Has This Been Tested?

Unit tests:

• AsyncJobDataHelperTest: job_cmd_info is encrypted for each of the userdata commands
• AsyncJobDaoImplTest: countPendingJobs matches on the decrypted command info
• ApiServerTest: userdata is masked in the async job event description

How did you try to break this feature and the system with this change?

Checked every consumer of job_cmd_info. Most read it through AsyncJobVO.getCmdInfo(), which decrypts it. The only SQL match on the column was countPendingJobs, which is fixed here. Rows written before the upgrade are plain JSON, and decryptIfNeeded returns those unchanged.

🤖 Generated with Claude Code

[DaanHoogland]

@daviftorres can you review this?

[codecov]

Codecov Report

❌ Patch coverage is 81.81818% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 18.34%. Comparing base (d02adcd) to head (c820081).

Files with missing lines	Patch %	Lines
...cloudstack/framework/jobs/dao/AsyncJobDaoImpl.java	80.00%	0 Missing and 1 partial ⚠️
server/src/main/java/com/cloud/api/ApiServer.java	83.33%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               4.22   #14588      +/-   ##
============================================
+ Coverage     18.32%   18.34%   +0.02%     
- Complexity    16644    16653       +9     
============================================
  Files          5939     5939              
  Lines        537768   537771       +3     
  Branches      65929    65928       -1     
============================================
+ Hits          98551    98678     +127     
+ Misses       428008   427844     -164     
- Partials      11209    11249      +40     

Flag	Coverage Δ
uitests	4.08% <ø> (ø)
unittests	19.44% <81.81%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
46.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[DaanHoogland]

@blueorangutan package

[blueorangutan]

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

[blueorangutan]

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19923

[DaanHoogland]

@blueorangutan test

[blueorangutan]

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests