On 05/30/2012 04:14 AM, Jacopo Cappellato wrote:
> Would you agree in adopting the following as a best practice for OFBiz
> logging: do not include full maps/lists in the output or if really necessary
> limit this to verbose output.
>
> For example, avoid code like this:
>
> Debug.logInfo("Capture [" + serviceName + "] : " + captureContext,
> module);
Additionally, this is *SUPER BAD NONO DEATH* for PCI compliance. In
the following example, it is printing out a CreditCard entity, which
is mightly frowned upon. Even if in this case it's an entity that
encrypts it's fields during toString(), there may be a parameters in
the context that contains an incoming credit card number that is
unencrypted.
>
> that generates the following output:
>
> [java] 2012-05-30 11:07:42,676 (http-bio-0.0.0.0-8443-exec-4)
> [PaymentGatewayServices.java:1752:INFO ] Capture [testCCCapture] :
> {userLogin=[GenericEntity:UserLogin][createdStamp,2012-05-30
> 11:03:31.383(java.sql.Timestamp)][createdTxStamp,2012-05-30
> 11:03:31.275(java.sql.Timestamp)][currentPassword,null()][disabledDateTime,null()][enabled,N(java.lang.String)][externalAuthId,null()][hasLoggedOut,null()][isSystem,Y(java.lang.String)][lastCurrencyUom,null()][lastLocale,null()][lastTimeZone,null()][lastUpdatedStamp,2012-05-30
> 11:03:57.136(java.sql.Timestamp)][lastUpdatedTxStamp,2012-05-30
> 11:03:57.049(java.sql.Timestamp)][partyId,system(java.lang.String)][passwordHint,null()][requirePasswordChange,null()][successiveFailedLogins,null()][userLdapDn,null()][userLoginId,system(java.lang.String)],
>
> orderPaymentPreference=[GenericEntity:OrderPaymentPreference][billingPostalCode,null()][createdByUserLogin,admin(java.lang.String)][createdDate,2008-04-23
> 16:49:27.966(java.sql.Timest
amp)][createdStamp,2012-05-30
11:04:26.446(java.sql.Timestamp)][createdTxStamp,2012-05-30
11:04:25.488(java.sql.Timestamp)][finAccountId,null()][lastUpdatedStamp,2012-05-30
11:07:42.63(java.sql.Timestamp)][lastUpdatedTxStamp,2012-05-30
11:07:38.495(java.sql.Timestamp)][manualAuthCode,null()][manualRefNum,null()][maxAmount,50.85(java.math.BigDecimal)][needsNsfRetry,N(java.lang.String)][orderId,DEMO10090(java.lang.String)][orderItemSeqId,null()][orderPaymentPreferenceId,9000(java.lang.String)][overflowFlag,N(java.lang.String)][paymentMethodId,9015(java.lang.String)][paymentMethodTypeId,CREDIT_CARD(java.lang.String)][presentFlag,N(java.lang.String)][processAttempt,1(java.lang.Long)][productPricePurposeId,null()][securityCode,null()][shipGroupSeqId,null()][statusId,PAYMENT_AUTHORIZED(java.lang.String)][swipedFlag,N(java.lang.String)][track2,null()],
paymentConfig=payment.properties, paymentGatewayConfigId=null, currency=USD,
captureAmount=50.85, authTrans=[GenericEntity:PaymentGa
tewayResponse][altReference,1338368862594(java.lang.String)][amount,50.85(java.math.BigDecimal)][createdStamp,2012-05-30
11:07:42.619(java.sql.Timestamp)][createdTxStamp,2012-05-30
11:07:38.495(java.sql.Timestamp)][currencyUomId,USD(java.lang.String)][gatewayAvsResult,null()][gatewayCode,100(java.lang.String)][gatewayCvResult,null()][gatewayFlag,A(java.lang.String)][gatewayMessage,This
is a test processor; no payments were captured or
authorized.(java.lang.String)][gatewayScoreResult,null()][lastUpdatedStamp,2012-05-30
11:07:42.619(java.sql.Timestamp)][lastUpdatedTxStamp,2012-05-30
11:07:38.495(java.sql.Timestamp)][orderPaymentPreferenceId,9000(java.lang.String)][paymentGatewayResponseId,10000(java.lang.String)][paymentMethodId,9015(java.lang.String)][paymentMethodTypeId,CREDIT_CARD(java.lang.String)][paymentServiceTypeEnumId,PRDS_PAY_REAUTH(java.lang.String)][referenceNum,1338368862594(java.lang.String)][resultBadCardNumber,null()][resultBadExpire,null()][resultDeclined,null
()][resultNsf,null()][subReference,null()][transCodeEnumId,PGT_AUTHORIZE(java.lang.String)][transactionDate,2012-05-30
11:07:42.619(java.sql.Timestamp)]}
>
> If you will agree we could proceed at fixing existing code or at least make
> sure that new code is clean.
>
> Kind regards,
>
> Jacopo
>
