raydac/java-comment-preprocessor

Mask password in "Added MAVEN property..." info messages / allow suppress the messages

vlsi opened this issue · 5 comments

vlsi commented

The list of valid variables is very helpful for initial usage of JCP, so it is good it is enabled by default.

However:

  1. It is not that safe to print all the properties (e.g. mvn.project.property.password, mvn.project.property.gpg.passphrase, etc). maven logs can be copy&pasted and it might lead to unexpected sharing of the passwords.

  2. It would be nice to have a configuration property to suppress that output (as it would no longer be required after JCP comments are in place)

raydac commented

good point

vlsi commented

Re 1, varName.toLower().contains("pass") || varName.toLower().contains("key") might be a good start.

raydac commented

may be print them only in verbose mode?

vlsi commented

may be print them only in verbose mode?

That will work provided it is documented in "quick start" section

raydac commented

I made some changes to hide potentially private properties content in maven log, 7b6fc2d