This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/tostring in repository https://gitbox.apache.org/repos/asf/cxf-xjc-utils.git
commit e8b79a7a6625710185a246629564608d70c06ec4 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Tue Oct 20 08:12:26 2026 +0100 Document that generated toString() includes sensitive fields --- README.md | 2 +- .../main/java/org/apache/cxf/xjc/runtime/JAXBToStringStyle.java | 5 ++++- ts/src/main/java/org/apache/cxf/xjc/ts/ToStringPlugin.java | 9 ++++++++- 3 files changed, 13 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index efe5db9..6879dfd 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ A collection of XJC (JAXB XML-to-Java compiler) plugins and utilities for use wi | `bug671` | Fix for XJC bug 671 — corrects generated code for certain schema patterns | | `bug986` | Fix for XJC bug 986 — corrects generated code for certain schema patterns | | `dv` | Data validation plugin — annotates generated classes with Bean Validation (JSR-303) constraints derived from XML Schema facets (e.g. `minLength`, `maxOccurs`, `pattern`) | -| `ts` | Type substitution plugin — enables proper handling of `xsi:type` substitution in generated code | +| `ts` | toString plugin — adds a `toString()` to generated classes that prints the value of every field (using `cxf-xjc-runtime` at runtime). This includes any sensitive data, such as passwords or tokens, so take care when logging generated objects | | `wsdlextension` | WSDL extension utilities — supports additional WSDL processing during CXF code generation | ## Usage diff --git a/runtime/src/main/java/org/apache/cxf/xjc/runtime/JAXBToStringStyle.java b/runtime/src/main/java/org/apache/cxf/xjc/runtime/JAXBToStringStyle.java index 390e1a2..9fdbcc1 100644 --- a/runtime/src/main/java/org/apache/cxf/xjc/runtime/JAXBToStringStyle.java +++ b/runtime/src/main/java/org/apache/cxf/xjc/runtime/JAXBToStringStyle.java @@ -31,7 +31,10 @@ import org.apache.commons.lang3.builder.ToStringStyle; /* - * Override default styles to recognise JAXBElement as needing introspection + * Override default styles to recognise JAXBElement as needing introspection. + * + * These styles print the value of every field of an object, so any sensitive data it holds, + * e.g. passwords or tokens, is included in its toString() and wherever that is logged. */ public final class JAXBToStringStyle { diff --git a/ts/src/main/java/org/apache/cxf/xjc/ts/ToStringPlugin.java b/ts/src/main/java/org/apache/cxf/xjc/ts/ToStringPlugin.java index 2c25cb5..bbf1200 100644 --- a/ts/src/main/java/org/apache/cxf/xjc/ts/ToStringPlugin.java +++ b/ts/src/main/java/org/apache/cxf/xjc/ts/ToStringPlugin.java @@ -40,6 +40,11 @@ import com.sun.tools.xjc.outline.Outline; /** * Modifies the JAXB code model to override the Object.toString() method with an * implementation that provides a String representation of the xml content. + * <p> + * The generated toString() includes the value of every field, so passwords, tokens or + * personal data held in a generated object end up wherever the object is logged or printed. + * Avoid logging such objects, or use -Xts:style with a ToStringStyle that leaves out or masks + * the sensitive fields. */ public class ToStringPlugin { @@ -64,7 +69,9 @@ public class ToStringPlugin { + " equivalent to: " + "-Xts:style:org.apache.cxf.xjc.runtime.JAXBToStringStyle.SIMPLE_STYLE\n" + " -Xts:style:org.apache.commons.lang3.builder.ToStringStyle.FIELD : The full class+field\n" - + " name of the ToStringStyle to use."; + + " name of the ToStringStyle to use.\n" + + " Note: toString() includes the value of every field, including any sensitive\n" + + " data, so take care when logging generated objects."; } public int parseArgument(Options opt, String[] args, int index, com.sun.tools.xjc.Plugin plugin)
