[jira] [Commented] (FELIX-6107) Loggging Passwords when invoking activate Method

["Carsten Ziegeler (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/FELIX-6107?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16829982#comment-16829982 ] 

Carsten Ziegeler commented on FELIX-6107:
-----------------------------------------

SCR does not know about metatype and there might not even be a metatype description for sensitive data. I think the only option we have is to not log configuration values (and derived objects) at all.

> Loggging Passwords when invoking activate Method
> ------------------------------------------------
>
>                 Key: FELIX-6107
>                 URL: https://issues.apache.org/jira/browse/FELIX-6107
>             Project: Felix
>          Issue Type: Bug
>          Components: Declarative Services (SCR)
>    Affects Versions: scr-2.1.16
>            Reporter: Stefan Bischof
>            Priority: Critical
>
> Configurations with an MetaType - AttributeDefinitions of the Type "Password" shouldn't be logged.
>  
> got this Log:
> {code:java}
> invoking activate: act: parameters [my.domain.my.Service$Cfg : {hashCode=0, pw=hack, equals=false, annotationType=null, toString=null}]{code}
>  
> From:
> org.apache.felix.scr.impl.inject.methods.BaseMethod:invokeMethod:Line 226/227
>  
> The MetaType of the parameter is "password"
>  
>  
>  
>  
>  



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)