[GitHub] [cloudstack] lujiefsi edited a comment on pull request #4537: CLOUDSTACK-10424:Potential sensitive information disclosure

[GitBox <gi...@apache.org>]

lujiefsi edited a comment on pull request #4537:
URL: https://github.com/apache/cloudstack/pull/4537#issuecomment-744122732


   > I don't agree.
   
   Hum, I give this patch for two reasons:
   
   - this log just indicate that "Unable to find a wakeup dispatcher from the joined job". I have check the code, it finds the dispatcher by jobId. so there's no need to print all detail of the job in this case, just jobID is ok, as other TRACE level log in this file,
   - if we enable TRACE level log for some reason, the password can be logged into files  which can then be propagated to other log systems, i.e Splunk where we can't make sure the log file are protected. 
   
   I know current change is bad for debugging, but i still think the sensitive information  is more important, and in this case, password is not usefull to debug. In order to make the log be useful to debug, i will change the patch as:
   `s_logger.trace("Unable to find a wakeup dispatcher from the joined job:" + StringUtils.cleanString(job.toString()));`
   
   Hope for more discussion!


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org