Mask proxy password in ProxySettings toString

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Done
    • Priority: Critical - P2
    • 5.9.2
    • Affects Version/s: 4.11.0
    • Component/s: None
    • None
    • Java Drivers
    • Not Needed
    • None
    • None
    • None
    • None
    • None
    • None

      ProxySettings.toString() includes the raw SOCKS5 proxy password. Since SocketSettings.toString() and MongoClientSettings.toString() embed it, and the sync, reactive-streams, and legacy drivers log the full settings at INFO on every MongoClient creation, the plaintext proxy password is written to application logs.

      Fix: mask the password in ProxySettings.toString() (e.g. password=), matching the existing convention in MongoCredential.toString().

       

            Assignee:
            Almas Abdrazak
            Reporter:
            Almas Abdrazak
            Ross Lawley
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: