Skip to content

Passwords should be excluded from toString #16851

@mgrafl

Description

@mgrafl

For the Java Spring generator (and potentially others), the generated toString method includes all properties:

{{#vars}}sb.append(" {{name}}: ").append(toIndentedString({{name}})).append("\n");

The properties may include sensitive information, such as passwords.
Since the toString method is primarily used for logging purposes, sensitive information should be redacted (see also CWE-532).

The OpenAPI specification already has the modifier property called format, that can be set to password as a hint that a field contains sensitive information (see https://spec.openapis.org/oas/v3.1.0#data-types).

Proposed mitigation:

  • The generator(s) should honor this hint in the generated toString method and skip (or redact) fields that are marked as format: password.

Compatibility considerations:

  • Since the toString method includes the class name before the opening curly brackets, there is no risk that developers might mistakenly use the toString method for JSON serialization.

Related issues:

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions