You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug/vulnerability
When the StringSource is used, the actual data is visible via Configuration's toString() method, which is not desirable. Note: This does not happen with other sources, such as URL or File, in which the system displays the path to the source, instead.
To Reproduce
Create a new Configuration using the StringSource containing a valid JSON document or properties file
Print the Configuration to the system console
Expected behavior
The system should not print the actual data, which can contain sensitive information that might be accessed without proper tracing. Instead, the system could print some "dummy"/random path (similar to the approach used by the Configuration objects generated by the mergers).
Screenshots
Example of toString result generated by string source (current behavior, unexpected): {"namespace":"test","precedence":0,"source":"StringSource(myFileName=config1\n myString=cust1)"}
Example of toString result generated by merger (desirable also for string source): {"namespace":"test","precedence":20,"source":"DummySource(7728eee7-a79a-42ed-aec8-1d83b39ed7b2)"}
Desktop:
OS: Windows 11
Browser: N/A
Version: 2.1.0
Additional context
N/A
The text was updated successfully, but these errors were encountered:
oswaldobapvicjr
changed the title
Avoid sendind configuration data output via Configuration.toString()
Avoid configuration data output via Configuration.toString()
Jul 6, 2022
How do you expect this change to be handled in the following test: net.obvj.confectory.ConfigurationTest.toString_validString() (line 96) ?
Hey @stingermissile!
Thank you for your interest in supporting the Confectory! 😃
I would like the Source part of the toString() output to be "StringSource(UUID)".
For example: StringSource(7728eee7-a79a-42ed-aec8-1d83b39ed7b2)
You may find a similar example on DummySource.java.
For the JUnit test, since the UUID is random, it's OK to evaluate the that the output contains at least the fixed part "StringSource".
…String() (#87)
* Issue 84 : https://github.com/firstcontributions/first-contributions
* Added Simple Class Name to toString
* Added StringSource check to toString test, and removed commented code.
* final modifier added to uuid
Co-authored-by: stingermissile <omega.engine@bigpond.com>
Describe the bug/vulnerability
When the
StringSource
is used, the actual data is visible viaConfiguration
'stoString()
method, which is not desirable.Note: This does not happen with other sources, such as
URL
orFile
, in which the system displays the path to the source, instead.To Reproduce
Configuration
using theStringSource
containing a valid JSON document or properties fileConfiguration
to the system consoleExpected behavior
The system should not print the actual data, which can contain sensitive information that might be accessed without proper tracing. Instead, the system could print some "dummy"/random path (similar to the approach used by the Configuration objects generated by the mergers).
Screenshots
Example of toString result generated by string source (current behavior, unexpected):
{"namespace":"test","precedence":0,"source":"StringSource(myFileName=config1\n myString=cust1)"}
Example of toString result generated by merger (desirable also for string source):
{"namespace":"test","precedence":20,"source":"DummySource(7728eee7-a79a-42ed-aec8-1d83b39ed7b2)"}
Desktop:
Additional context
N/A
The text was updated successfully, but these errors were encountered: