File: orcid-persistence/src/main/java/org/orcid/persistence/jpa/entities/UserconnectionEntity.java
Line: 211-214
Current code:
public String toString() {
return "UserconnectionEntity [id=" + id + ", accesstoken=" + accesstoken + ", displayname=" + displayname + ", email=" + email + ", expiretime=" + expiretime
+ ", imageurl=" + imageurl + ", lastLogin=" + lastLogin + ", orcid=" + orcid + ", profileurl=" + profileurl + ", rank=" + rank + ", refreshtoken="
+ refreshtoken + ", secret=" + secret + ", isLinked=" + isLinked + ", idType=" + idType + ", connectionSatus=" + connectionSatus + "]";
}
Problem: accesstoken, refreshtoken, and secret fields are printed in plain text whenever this entity is logged, debugged, or its toString() is called. This leaks live OAuth credentials into application logs.
Suggested fix:
public String toString() {
return "UserconnectionEntity [id=" + id + ", accesstoken=, displayname=" + displayname + ", email=" + email + ", expiretime=" + expiretime
+ ", imageurl=" + imageurl + ", lastLogin=" + lastLogin + ", orcid=" + orcid + ", profileurl=" + profileurl + ", rank=" + rank + ", refreshtoken="
+ ", secret=****, isLinked=" + isLinked + ", idType=" + idType + ", connectionSatus=" + connectionSatus + "]";
}
File: orcid-persistence/src/main/java/org/orcid/persistence/jpa/entities/UserconnectionEntity.java
Line: 211-214
Current code:
public String toString() {
return "UserconnectionEntity [id=" + id + ", accesstoken=" + accesstoken + ", displayname=" + displayname + ", email=" + email + ", expiretime=" + expiretime
+ ", imageurl=" + imageurl + ", lastLogin=" + lastLogin + ", orcid=" + orcid + ", profileurl=" + profileurl + ", rank=" + rank + ", refreshtoken="
+ refreshtoken + ", secret=" + secret + ", isLinked=" + isLinked + ", idType=" + idType + ", connectionSatus=" + connectionSatus + "]";
}
Problem: accesstoken, refreshtoken, and secret fields are printed in plain text whenever this entity is logged, debugged, or its toString() is called. This leaks live OAuth credentials into application logs.
Suggested fix:
public String toString() {
return "UserconnectionEntity [id=" + id + ", accesstoken=, displayname=" + displayname + ", email=" + email + ", expiretime=" + expiretime
+ ", imageurl=" + imageurl + ", lastLogin=" + lastLogin + ", orcid=" + orcid + ", profileurl=" + profileurl + ", rank=" + rank + ", refreshtoken="
+ ", secret=****, isLinked=" + isLinked + ", idType=" + idType + ", connectionSatus=" + connectionSatus + "]";
}