Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Passwords shown in log #100

Closed
aleksandrs-ledovskis opened this issue Oct 2, 2017 · 5 comments
Closed

Passwords shown in log #100

aleksandrs-ledovskis opened this issue Oct 2, 2017 · 5 comments

Comments

@aleksandrs-ledovskis
Copy link

Despite "Show password in clear text in log file" checkbox being unchecked, authentication password is clearly visible in rows generated by observer activity.

Example:

1st-setup:2017-9-0 23:39:4.594:edc07453-c547-ba4b-911c-8a6521acfea9: ecExchangeRequest observing http-on-modify-request for URI https://USERNAME:PASSWORD@outlook.office365.com/EWS/Exchange.asmx originalURI https://USERNAME:PASSWORD@outlook.office365.com/EWS/Exchange.asmx
@Trim
Copy link
Member

Trim commented Oct 2, 2017

Hello,

I think that's due to the 52 release workaround.
We need to fix it, thanks !

@advancingu
Copy link
Member

@Trim Can you provide a link to the commit or PR that caused this?

@Trim
Copy link
Member

Trim commented Oct 11, 2017 •
edited

Yes, that was introduced by commit 7ff3849 which introduces the observe() function in ExchangeRequest.js.

The informations logged expose the full URI.scheme which contains username and password.

The fix I was writting (but currently not tested) is to construct the URL with all informations except password if the user want to hide it.

@Trim Trim mentioned this issue Nov 11, 2017
Merged
advancingu pushed a commit that referenced this issue Nov 11, 2017
@Trim
ecExchangeRequest.js: hide password in logs.
c0847ea 
The observer created on 'http-on-modify-request' was showing password in logs
even if the user asked to not show password in logs.

This patch automatically replaces password by `***` in the URIs before logging them.

Fix #100
@master-lincoln
Copy link

Looks like this can be closed.

@Trim
Copy link
Member

Trim commented Feb 9, 2018

Indeed, it should be fixed with release 4.0.0-beta5.

@Trim Trim closed this as completed Feb 9, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@advancingu @Trim @master-lincoln @aleksandrs-ledovskis