Skip to content

Commit 60dbb20

Browse files
Exclude TLS key password from chaincode server log
The constructor for the NettyGrpcServer implementation included an info level log of all of the chaincode server properties, including the TLS key password. While both the key and accompanying password are necessary to allow the chaincode server to be impersonated, an attacker with access to the chaincode server filesystem where the key is stored would likely also have access to the logs containing the key password. The password is sensitive information that should not be logged regardless. Signed-off-by: Mark S. Lewis <Mark.S.Lewis@outlook.com>
1 parent 2189bae commit 60dbb20

1 file changed

Lines changed: 0 additions & 1 deletion

File tree

fabric-chaincode-shim/src/main/java/org/hyperledger/fabric/shim/NettyGrpcServer.java

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,6 @@ public NettyGrpcServer(final ChaincodeBase chaincodeBase, final ChaincodeServerP
7070
LOGGER.info("PermitKeepAliveTimeMinutes:" + chaincodeServerProperties.getPermitKeepAliveTimeMinutes());
7171
LOGGER.info("KeepAliveTimeMinutes:" + chaincodeServerProperties.getKeepAliveTimeMinutes());
7272
LOGGER.info("PermitKeepAliveWithoutCalls:" + chaincodeServerProperties.getPermitKeepAliveWithoutCalls());
73-
LOGGER.info("KeyPassword:" + chaincodeServerProperties.getKeyPassword());
7473
LOGGER.info("KeyCertChainFile:" + chaincodeServerProperties.getKeyCertChainFile());
7574
LOGGER.info("KeyFile:" + chaincodeServerProperties.getKeyFile());
7675
LOGGER.info("isTlsEnabled:" + chaincodeServerProperties.isTlsEnabled());

0 commit comments

Comments
 (0)