Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WARN log expose the details of method parameters #329

Open
Tony-Sun-MANU opened this issue May 12, 2021 · 0 comments
Open

WARN log expose the details of method parameters #329

Tony-Sun-MANU opened this issue May 12, 2021 · 0 comments

Comments

@Tony-Sun-MANU
Copy link

Tony-Sun-MANU commented May 12, 2021

We are using annotation @loggable in a rest controller class with value = Loggable.TRACE so that nothing is logged normally because the methods under this class process a lot of sensitive personally identifiable information (PII) data. But we found that if the execution time of any method in this class goes beyond the value of limit() in Loggable class, it will create a WARN log with all the details of parameters of that method. This is dangerous as it exposes the sensitive data in the parameters unexpectedly. I searched online and found developers usually do not pay attention to the value of limit() in Loggable when they add @loggable to their class, and they don't particularly customize that value in annotation, and the WARN logs usually are not caught during the testing. So there is a danger to expose the sensitive data in the logs. Can you please add a setting so that one can turn this feature on or off at a global level rather than having to set limit value for every annotation? Or update it so that it does not expose the details of the method parameters? Thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants