Skip to content

Remove logging of user supplied values #286

@paulboocock

Description

Describe the bug
There are a number of instances where it is possible to the tracker to log data passed to it. This is typically seen as bad practice (even when the logs are "innocently" debug logs). Additional light has been shed on this practice with the recent Log4j 2 CVE-2021-44228.

Whilst the Java Tracker doesn't use log4j (at least directly, it uses the sfl4j facade), this CVE has highlighted that logging keys/values is generally something we shouldn't do. debug logging is fine, as that shouldn't be enabled in production and makes debugging far easier when keys/values are listed in the logs. I've listed some debug logging just so another pair of eyes can verify leaving them in seems correct.

To Reproduce
Steps to reproduce the behavior or code snippets that produce the issue.

Expected behavior
No properties passed into the Java Trackers functinos should be logged at info or higher.

Below are the logs I found. I'm not sure they all need fixing as some are debug level but listing here for completeness.

LOGGER.error("Could not process Map {} into JSON String: {}", map, e.getMessage());

LOGGER.error("Object {} could not be encoded: {}", o, e.getMessage());

Wrapped with null checks so probably fine, but perhaps printing the value seems pointless.

Wrapped with null checks so probably fine, but perhaps printing the value seems pointless.

Metadata

Metadata

Assignees

No one assigned

    Labels

    status:completedCompleted - but might not be released yet.type:enhancementNew features or improvements to existing features.

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions