search

adafruit / Adafruit_CircuitPython_ESP32SPI

ESP32 as wifi with SPI interface
MIT License
101 stars 74 forks source link

Prints password in clear text if debug is True #156

Closed FoamyGuy closed 1 year ago

FoamyGuy commented 2 years ago

This library prints the wifi password from secrets.py in cleartext if debug is True from the code here:

https://github.com/adafruit/Adafruit_CircuitPython_ESP32SPI/blob/52208e4752bee510b24ac775763776231b5912cc/adafruit_esp32spi/adafruit_esp32spi.py#L531

I can see how this could be helpful for troubleshooting, especially noticing if the password was incorrect. But I think it should require an extra boolean parameter or something to do this.

I would like to see all the rest of the debugging messages printed, but don't really want my password printed along with it.

rsbohn commented 2 years ago

Make debug safe for streaming.

dhalbert commented 2 years ago

How about if debug is 1 or True it doesn't print the password? If debug is >=2, it does print the password. Something like that.

FoamyGuy commented 2 years ago

@dhalbert that sounds like a good solution to me

tannewt commented 2 years ago

I'd prefer a separate show_passwords kwarg. A kwarg is self documenting. A different debug value isn't.