Skip to content

Commit ee6eb99

Browse files
committed
JVMCBC-1686 CertificateAuthenticator.toString() can include unprotected private key
Motivation ---------- Prior to this change, the toString() method of an authenticator created by CertificateAuthenticator.fromKey() includes the private key. This could potentially result in the private key appearing in application logs -- but only if the user explicitly logs the authenticator. Modifications ------------- Change CertificateAuthenticator.toString() to return just "CertificateAuthenticator". Omit `keyManagerFactory` because it's a supplier whose toString() is not interesting. Omit `keyCertChain` because it's not particularly useful. Change-Id: I733830eb8784f9c0195074903544ee8eb42ce334 Reviewed-on: https://review.couchbase.org/c/couchbase-jvm-clients/+/233953 Tested-by: Build Bot <[email protected]> Reviewed-by: Michael Reiche <[email protected]>
1 parent 334b5e4 commit ee6eb99

File tree

1 file changed

+2
-5
lines changed

1 file changed

+2
-5
lines changed

core-io/src/main/java/com/couchbase/client/core/env/CertificateAuthenticator.java

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -158,11 +158,8 @@ public boolean supportsNonTls() {
158158

159159
@Override
160160
public String toString() {
161-
return "CertificateAuthenticator{" +
162-
"key=" + key +
163-
", keyCertChain=" + keyCertChain +
164-
", keyManagerFactory=" + keyManagerFactory +
165-
'}';
161+
// Intentionally omit sensitive info like private key.
162+
return "CertificateAuthenticator";
166163
}
167164

168165
}

0 commit comments

Comments
 (0)