Re: [PR] sensitive information leak to log [cloudstack]

["abh1sar (via GitHub)" <gi...@apache.org>]

abh1sar commented on code in PR #12018:
URL: https://github.com/apache/cloudstack/pull/12018#discussion_r2660998306


##########
core/src/main/java/com/cloud/storage/template/HttpTemplateDownloader.java:
##########
@@ -151,7 +151,7 @@ private void checkCredentials(String user, String password) {
                 client.getParams().setAuthenticationPreemptive(true);
                 Credentials defaultcreds = new UsernamePasswordCredentials(user, password);
                 client.getState().setCredentials(new AuthScope(hostAndPort.first(), hostAndPort.second(), AuthScope.ANY_REALM), defaultcreds);
-                logger.info("Added username=" + user + ", password=" + password + "for host " + hostAndPort.first() + ":" + hostAndPort.second());
+                logger.info("Added username={}" + user + ", password=****** for host {}:{}”, hostAndPort.first(), hostAndPort.second());

Review Comment:
   ```suggestion
                   logger.info("Added username={}, password=****** for host {}:{}”, user, hostAndPort.first(), hostAndPort.second());
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org