-
Notifications
You must be signed in to change notification settings - Fork 79
Closed
Description
When the database connection to the job-repository cannot be established (using the JdbcRepository), then an exception is thrown:
throw BatchMessages.MESSAGES.failToObtainConnection(e, dbUrl, dbProperties); |
The exception message is constructed using the 'dbProperties':
@Message(id = Message.INHERIT, value = "Failed to obtain connection from %s, %s") |
The 'dbProperties' might contain username and password for the database-connection. So if this exception is logged, the resulting log might looks like this:
"JBERET000622 Failed to obtain connection from <jdbc-url>, {password=<password_in_plain_text>, user=<username_in_plain_text>}"
Therefore, database-credentails might be logged unobfuscated as plain text to the console and are visible for everyone that has access to it - which might be a security risk.
Metadata
Metadata
Assignees
Labels
No labels