Jonathan created PROTON-2962:
--------------------------------
Summary: password exposed in log at INFO level
Key: PROTON-2962
URL: https://issues.apache.org/jira/browse/PROTON-2962
Project: Qpid Proton
Issue Type: Bug
Reporter: Jonathan
The whole URL is logged at INFO level, containing sensitive information, such
as the password. As logs might be accessible at a other permission level then
the credentials, the password should be redacted IMO.
Related section of the python binding:
[https://github.com/apache/qpid-proton/blob/main/python/proton/_reactor.py#L1042]
```diff
- _logger.info("Connecting to %r..." % url)
+ log_url = Url(url)
+ if log_url.password:
+ log_url.password = "********"
+ _logger.info("Connecting to %r..." % log_url)
```
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
