search

IOT-DSA / dslink-java-opc

OPC DSLink
GNU General Public License v3.0
3 stars 3 forks source link

Connection password is stored/shown in clear text as an attribute #6

Open mbreissi opened 6 years ago

mbreissi commented 6 years ago

In OpcConn.java, the connection information is stored as attributes, including the password. As an attribute, the password is then freely viewable in clear text by assorted tools.

Suggest 2 steps to resolve this issue:

  1. Store connection information as configs rather than attributes (setConfig() vs. setAttribute()).
  2. Use the setPassword() Java SDK call for encrypting the password and preventing it from being viewed in clear text by the tools