Passwords are being logged in plain text in beforeSave

[all-iver]

Issue Description

Possibly related to #1704.

Passwords are being logged in plain text for me in beforeSave when I create a new user. They show up in my nodejs.log and in parse-dashboard. This is with verbose mode turned off.

Steps to reproduce

In your beforeSave, do something like the following (not sure if this is a necessary step but it's what I'm doing):

    if (!user.existed()) {
        user.set('someOtherKey', 0);
        response.success();
        return;
    } 

Then, create a new user.

Expected Results

No passwords should ever be displayed or stored in plain text.

Actual Outcome

I get this in my logs:

info: beforeSave triggered for _User for user undefined:
  Input: {"email":"[email protected]","username":"[email protected]","password":"my-password","someOtherKey":0}
  Result: {"object":{"email":"[email protected]","username":"[email protected]","password":"my-password","someOtherKey":0}} className=_User, triggerType=beforeSave, user=undefined

Environment Setup

• Server
  • parse-server version (Be specific! Don't say 'latest'.) : 2.2.18
  • Operating System: Mac OSX or Linux
  • Hardware: Macbook Pro or AWS instance
  • Localhost or remote server? (AWS, Heroku, Azure, Digital Ocean, etc): any
• Database
  • MongoDB version: any
  • Storage engine: any
  • Hardware: any
  • Localhost or remote server? (AWS, mLab, ObjectRocket, Digital Ocean, etc): any

Logs/Trace

See above.

[all-iver]

Bump on this - is there a quick or simple workaround? We need to migrate very soon to allow users enough time to upgrade before the cutoff. I can't in good conscience have users' plain text passwords be stored in log files on our instances. But having logs is important too.

[flovilmart]

Can you update to 2.2.21 and let us know if the error still reproduces?

[all-iver]

Hey, thanks for the response - yes, I just updated to 2.2.21 and can confirm it still happens. The first log message after I try to create an account is a beforeSave that contains the user's plain-text password.

[acinader]

ugh, i'm guessing that this is cause we're logging the params in the hooks. I can cook up a failing unit test.

[flovilmart]

@acinader go ahead!

[acinader]

@flovilmart failing unit test: master...acinader:password-obsfucate-cloud-triggers

the first approach that comes to mind is to change logger.truncateLogMessage to logger.cleanAndTruncate....

And just search and replace on "password":"[^"]*"

thoughts?

[flovilmart]

@acinader that seems reasonable, I opened the PR with the failing test so we can keep track of the progress. any log for those should go through the cleaner :) Better perhaps, that should be at the loggerController level no? like implementing logRequest(level, ...args) and logResponse(level, ...args) 

[flovilmart]

@all-iver you can use: parseplatform/parse-server.git#latest if you can't wait till next release. Just pin to that version in your package.json.

[all-iver]

Great, thanks a lot for the quick fix!

[ashish4rawat]

but this is now fixed