[
https://issues.apache.org/jira/browse/VFS-854?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17850087#comment-17850087
]
Bernd Eckenfels edited comment on VFS-854 at 5/28/24 4:30 PM:
--------------------------------------------------------------
> You should maybe provide the creds separately
Agreed, however I propose that this debug log is changed to
getRootName().getFriendlyURL() instead. Same for the throw in SftpFileSystem
getChannel.
Unfortunatelly we cant change that for AbstractFileObject.toString() easily,
anymore.
was (Author: b.eckenfels):
> You should maybe provide the creds separately
Agreed, however I propose that this debug log is changed to
getRootName().getFriendlyURL() instead. Same for the throw in SftpFileSystem
getChannel.
> SoftRefFilesCache logs password when FS is closed
> -------------------------------------------------
>
> Key: VFS-854
> URL: https://issues.apache.org/jira/browse/VFS-854
> Project: Commons VFS
> Issue Type: Bug
> Affects Versions: 2.9.0
> Reporter: Andrey Turbanov
> Priority: Major
>
> We use DEBUG logging enabled for VFS to diagnose integration problems with
> external connections.
> Unfortunately it leads to logging of clear text password in logs if use basic
> auth with SFTP/HTTP4S connectors
> {noformat}
> D 240526 060013.993 [ScheduledIpfSynchronizer_Worker-1] SoftRefFilesCache -
> Close FileSystem: http4s://mylogin:[email protected]:8443/
> {noformat}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
