tapestry-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Jochen Kemnade (JIRA)" <j...@apache.org>
Subject [jira] [Closed] (TAP5-177) Method logging code should recognize an @Password annotation and obscure the output written to the log
Date Mon, 12 Jan 2015 08:10:50 GMT

     [ https://issues.apache.org/jira/browse/TAP5-177?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Jochen Kemnade closed TAP5-177.
-------------------------------
    Resolution: Invalid

We assume this is no longer relevant and therefore close it.
If you still have this issue in a recent Tapestry version (such as 5.3.8 or the latest 5.4
preview release), feel free to provide the necessary information and reopen.

> Method logging code should recognize an @Password annotation and obscure the output written
to the log
> ------------------------------------------------------------------------------------------------------
>
>                 Key: TAP5-177
>                 URL: https://issues.apache.org/jira/browse/TAP5-177
>             Project: Tapestry 5
>          Issue Type: Improvement
>    Affects Versions: 5.0.15
>            Reporter: Howard M. Lewis Ship
>            Priority: Minor
>              Labels: bulk-close-candidate
>
> Currently, log output may include plaintext passwords (or other secure data).  I nice
solution might be to mark parameters (or the method itself,i.e., the return value) as @Password
(or something similar) to clue in the logging code that the parameter in question should be
written out as a series of asterisks or otherwise obscured.
> @Secure is already taken; @SecureData, @NotForPryingEyes, @ObscureInOutput, something
similar?



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message