Azure / azure-sdk-for-sap-odata

This repository serves as foundation to power SAP OData SDK development for .NET
MIT License
7 stars 2 forks source link

[BUG] Clear text output of password when starting Azure Function #2

Closed lechnerc77 closed 1 year ago

lechnerc77 commented 1 year ago

Describe the bug

When executing the sample app setup and entering username and password in the local.settings.json the console output after func host start shows the password in clear text in standard and verbose mode. IMHO the password should never be displayed in the output.

To Reproduce

Steps to reproduce the behavior:

  1. Do the basic setup as described in the README.md
  2. Create a local.settings.json for the Azure Function in the FunctionsSample.GWSAMPLE_BASIC and add a password for the JSON key BasicHttpAuthHandler:Password.
  3. Start the Azure Fucntion via func host start or func host start --verbose
  4. Check the output in the console

Expected behavior The password should not be displayed. If desired the console could reflect that the password was set or not

Screenshots

Additional context

The issue is the code in the file Dependencies/DataOperations.Core/Auth/BasicHttpAuthHandler.cs - line 12 i.e. Console.WriteLine("Password: {0}", _options.Password);

using System.Text;
using Microsoft.Extensions.Options;
namespace DataOperations.Core.Auth.Http
{
    public class BasicHttpAuthHandler : IAuthHandler
    {
        private BasicHttpAuthHandlerOptions _options;
        public BasicHttpAuthHandler(IOptions<BasicHttpAuthHandlerOptions> options)
        {
            _options = options.Value;
            Console.WriteLine("UserName: {0}", _options.UserName);
            Console.WriteLine("Password: {0}", _options.Password);
        }
        public IOptions<BasicHttpAuthHandlerOptions> Options { get; }
        public async ValueTask<string> GetAuthStringAsync(string scope ="ALL")
        {
            return $"Basic {Convert.ToBase64String(Encoding.ASCII.GetBytes($"{_options.UserName}:{_options.Password}"))}";
        }
    }
}
MartinPankraz commented 1 year ago

added assignment check in this commit.