[
https://issues.apache.org/jira/browse/PROTON-2962?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrew Stitcher resolved PROTON-2962.
-------------------------------------
Fix Version/s: proton-c-0.41.0
Resolution: Duplicate
Already fixed for 0.41 in 976e2181c4c1daa6b84fd81465a0ca5cb98b39b8
> password exposed in log at INFO level
> -------------------------------------
>
> Key: PROTON-2962
> URL: https://issues.apache.org/jira/browse/PROTON-2962
> Project: Qpid Proton
> Issue Type: Bug
> Reporter: Jonathan
> Priority: Major
> Fix For: proton-c-0.41.0
>
>
> The whole URL is logged at INFO level, containing sensitive information, such
> as the password. As logs might be accessible at a other permission level then
> the credentials, the password should be redacted IMO.
> Related section of the python binding:
> [https://github.com/apache/qpid-proton/blob/main/python/proton/_reactor.py#L1042]
> ```diff
> - _logger.info("Connecting to %r..." % url)
> + log_url = Url(url)
> + if log_url.password:
> + log_url.password = "********"
> + _logger.info("Connecting to %r..." % log_url)
> ```
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
