RDKEMW-22475 : [SECVULN][7.5] Remove sensitive information from property files in /etc

[madhubabutt]

Reason for change: Remove sensitive information from property files in /etc
Test Procedure: Build RDKE with the change, verify rdkfwupdater, crash upload and log upload, and confirm stability with no crashes.
Risks: Medium
Priority: P1
Signed-off-by: Tirumala, Madhubabu (Contractor) Madhubabu_Tirumala@comcast.com

[Copilot]

Pull request overview

Removes hardcoded credentials and some environment-specific endpoints from /etc property files to mitigate a reported security vulnerability and reduce sensitive data shipped in default configuration.

Changes:

• Removed coredump/minidump upload usernames/passwords from etc/config.properties.
• Removed several internal service/proxy/TFTP/CDL/image endpoints from etc/common.properties and etc/config.properties.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
etc/config.properties	Removes hardcoded crash upload credentials and some endpoint configuration from /etc defaults.
etc/common.properties	Removes internal proxy/CDL/image/TFTP endpoint defaults from /etc configuration.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

etc/config.properties:28

• POTOMAC_SVR is still set to a specific IP address. If the intent is to remove sensitive/environment-specific endpoints from /etc, consider leaving this blank (or moving it to a secure/provisioned location).

POTOMAC_SVR=69.252.107.55

etc/common.properties:29

• POTOMAC_SVR is still set to a specific IP address. If /etc/*.properties should not contain environment-specific endpoints, consider blanking this value (or provisioning it securely at runtime).

POTOMAC_SVR=69.252.107.55

etc/config.properties:24

• PR title indicates removing sensitive information from /etc property files, but this file still hard-codes POTOMAC_USER and POTOMAC_IDENTITY_FILE. If these are environment-specific credentials/paths, they should be scrubbed (left blank) like the removed crash-upload credentials. Also note /etc/device.properties still contains CRASH_PORTAL_SERVER/CRASH_PORTAL_USER values, so the overall /etc scrub may be incomplete.

POTOMAC_USER=ccpstbscp
POTOMAC_IDENTITY_FILE=/.ssh/id_dropbear

[deepthi-ps]

Looks good from RDKM side.

[nhanasi]

LGTM

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

etc/common.properties:29

• Similar to etc/config.properties, this keeps POTOMAC_SVR as a hard-coded IP while removing other environment-specific values. If the intent is to scrub sensitive/environment-specific settings from /etc, consider leaving the keys present but empty (template-style) and blanking POTOMAC_SVR as well, so downstream scripts can still source the variables without shipping real addresses.

DEFAULT_IP=192.168.100.10
PROXY_FILE="/opt/persistent/usr/1112/703e/proxy-is-up"
LOG_PATH=/var/log
DEFAULT_PROXY_PORT=8080
POTOMAC_SVR=69.252.107.55

etc/config.properties:25

• This file is used as a config contract for crash upload settings (it’s sourced by /lib/rdk/core_shell.sh). Right now it removes some sensitive values, but also removes the keys entirely and still hard-codes POTOMAC_USER / POTOMAC_IDENTITY_FILE and POTOMAC_SVR. To avoid leaking environment-specific info while keeping compatibility, consider keeping the removed keys with empty values and blanking the remaining Potomac settings here (values should be provisioned/overridden securely elsewhere).

# coredump upload settings
PORTAL_URL=
POTOMAC_USER=ccpstbscp
POTOMAC_IDENTITY_FILE=/.ssh/id_dropbear
CRASH_PORTAL_PATH="/opt/crashportal_uploads/coredumps/"

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.