influxdata / influxdb-client-go

InfluxDB 2 Go Client
MIT License
611 stars 116 forks source link

InfoLevel logging is writing token/password in plain-text #312

Closed stigok closed 2 years ago

stigok commented 2 years ago

Steps to reproduce:

package main

import (
    "fmt"

    influxdb2 "github.com/influxdata/influxdb-client-go/v2"
    influxdb2log "github.com/influxdata/influxdb-client-go/v2/log"
)

func main() {
    client := influxdb2.NewClientWithOptions(
        "https://influx.example.com:8086",
        "username:password",
        influxdb2.DefaultOptions().SetLogLevel(influxdb2log.InfoLevel),
    )
    _ = client
}

Expected behavior: The token/password should be hidden or scrambled for InfoLevel. Maybe being shown in plain text for DebugLevel.

Actual behavior: The token/password is logged in plain text at info level

2022/03/01 12:23:08 influxdb2client I! Using URL 'https://influx.example.com:8087', token 'my-username:my-super-sensitive-password'

Specifications:

stigok commented 2 years ago

Thanks! Well done :)