[I] JMS appender prints `securityCredentials` in status logger messages [logging-log4j2]

["ppkarwasz (via GitHub)" <gi...@apache.org>]

ppkarwasz opened a new issue, #4345:
URL: https://github.com/apache/logging-log4j2/issues/4345

   ## Description
   
   The JMS appender prints its `securityCredentials` in clear text in status logger messages,
   although the attribute is declared with `@PluginBuilderAttribute(sensitive = true)`.
   
   - `JmsAppender.Builder` passes `securityCredentials` to `JndiManager.createProperties`,
     which stores it as `Context.SECURITY_CREDENTIALS` in the `jndiProperties` of `JmsManagerConfiguration`.
   - `JmsManagerConfiguration.toString()` prints the whole `jndiProperties` table.
   - That string is logged at `ERROR` when the manager cannot be created
     (`"Error creating JmsManager using JmsManagerConfiguration [{}]"`, `JmsManager`),
     i.e. at the default status logger level, on an ordinary broker outage.
   - `JmsAppender.Builder.toString()` also concatenates `securityCredentials`.
   
   The same code exists in `log4j-jakarta-jms`.
   
   Expected behavior: mask `Context.SECURITY_CREDENTIALS` (and any password) in both `toString()` methods,
   in `log4j-core` and `log4j-jakarta-jms`.
   
   
   ## Configuration
   
   **Version:** 2.26.1 (and `2.x` at `d631e82`)
   
   **Operating system:** any
   
   **JDK:** any
   
   ## Logs
   
   The `ERROR` message contains `java.naming.security.credentials=` followed by the credentials in clear text.
   
   ## Reproduction
   
   Configure a `JMS` appender with `securityCredentials` pointing to an unreachable broker and look at the status logger output.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] JMS appender prints `securityCredentials` in status logger messages [logging-log4j2]

["ppkarwasz (via GitHub)" <gi...@apache.org>]

ppkarwasz commented on issue #4345:
URL: https://github.com/apache/logging-log4j2/issues/4345#issuecomment-5831229566

   Related, at `DEBUG` status level only:
   
   - `PluginValueVisitor` prints the value of `@PluginValue` elements (e.g. `<Property>`) unmasked,
     while `PluginBuilderAttributeVisitor` replaces `sensitive` attributes with `*****`.
     `@PluginValue` has no `sensitive` member.
   - The `password` and `userName` attributes of `AbstractDriverManagerConnectionSource.Builder` are not marked `sensitive = true`.
     Being `char[]`, they currently print as an identity hash, but they should be masked explicitly.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] JMS appender prints `securityCredentials` in status logger messages [logging-log4j2]

["ppkarwasz (via GitHub)" <gi...@apache.org>]

ppkarwasz commented on issue #4345:
URL: https://github.com/apache/logging-log4j2/issues/4345#issuecomment-5831267131

   Also at `DEBUG` status level: `MongoDb4Provider` logs `"instantiated {}"` with its `toString()`,
   which includes the `ConnectionString`, and `ConnectionString.toString()` returns the original string,
   credentials included.
   The `connection` attribute of the builder is not marked `sensitive = true`,
   and an invalid connection string is also copied verbatim into the `IllegalArgumentException` message.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org