Logging of confidential parameters

[szzsolt]

I have a field defined as

@Option(names = {"-p", "--password"},
    descriptionKey = "the.password",
    interactive = true,
    arity = "0..1",
    echo = false,
    description = "Password")
private String password;

I also have a custom IDefaultValueProvider implementation that will load and decrypt an encrypted password from a file for the option.

It all works well, except when setting CommandLine.tracer().setLevel() to a high enough level. When I do that, the password is logged by picocli as below:

[picocli INFO] Setting field String ....password to 'ACTUAL_PASSWORD_VALUE' (was 'ACTUAL_PASSWORD_VALUE') for field String ....password on ...

It seems that the echo = false setting is ignored when it comes to default values. In the code I see that echo() is only checked based around certain other conditions.

Would it be possible to suppress all logging when echo is set to false, regardless of any other setting on the option?

[remkop]

Yes this is a good idea. Thank you for raising it!
Will you be able to provide a pull request for this (ideally with tests)?

[remkop]

Fixed in the main branch.
This will be included in the next release.
Thank you for raising this!