Skip to content

Credentials are printed to stdout for every request #3

@jenssuhr

Description

@jenssuhr
mannequin

Hello,
the following code in Communication (https://github.com/Vantiv/cnp-chargeback-sdk-java/blob/2.x/src/main/java/com/cnp/sdk/Communication.java#L212) prints all headers, including the Authorization header to stdout for every request without an option to deactivate this behavior:

try {
    HttpResponse response = httpClient.execute(baseRequest);
    return validateResponse(response);
} catch (IOException e) {
    throw new ChargebackException(CONNECTION_EXCEPTION_MESSAGE, e);
} finally {
    System.out.println("Headers");
    for(Header header : baseRequest.getAllHeaders()) {
        System.out.println(header.getName() +" : "+header.getValue());
    }
    baseRequest.abort();
}

In my opinion, this is both unnecessary and a potential security risk. Other debug logging uses printToConsole which is opt-in via configuration properties and masks sensitive information.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions