| Subject: | Using Showcredentials() to avoid showing credentials in debug mode. |
| Date: | Wed, 7 Oct 2015 01:50:19 +0200 |
| To: | bug-Mail-IMAPClient [...] rt.cpan.org |
| From: | Gilles LAMIRAL <gilles.lamiral [...] laposte.net> |
Hi Phil,
I'm often scared to see --debugimap output from imapsync with the big
caveat to reveal credentials published on the net via a mailing-list
archive, or even to myself only.
This is a small patch in sub _send_line() to avoid showing credentials
in Debug(1) mode, for the classical LOGIN authentication.
I saw you added Showcredentials and started to use it in sub _record()
so I used it and copied your code as a model.
Thanks in advance to include this or any better code/idea to
implement a way to mask credentials in debug mode.
Basically the change is only this:
my $debug ;
if ( !$self->Showcredentials && $string =~ /^(\d+\s+LOGIN\s+).*/ ) {
$debug = "$1 XXXXXXXX XXXXXXXX_Showcredentials_is_off" ;
}else{
$debug = $string ;
}
$self->_debug("Sending: $debug");
Here is the whole sub _send_line() function patched from Mail::IMAPClient 3.37:
# _send_line handles literal data and supports the Prewritemethod
sub _send_line {
my ( $self, $string, $suppress ) = @_;
$string =~ s/$CR?$LF?$/$CRLF/o
unless $suppress;
# handle case where string contains a literal
if ( $string =~ s/^([^$LF\{]*\{\d+\}$CRLF)(?=.)//o ) {
my $first = $1;
$self->_debug("Sending literal: $first\tthen: $string");
$self->_send_line($first) or return undef;
# look for "$tag NO" or "+ ..."
my $code = $self->_get_response( $self->Count, '+' ) or return undef;
return undef unless $code eq '+';
}
# non-literal part continues...
if ( my $prew = $self->Prewritemethod ) {
$string = $prew->( $self, $string );
}
my $debug ;
if ( !$self->Showcredentials && $string =~ /^(\d+\s+LOGIN\s+).*/ ) {
$debug = "$1 XXXXXXXX XXXXXXXX_Showcredentials_is_off" ;
}else{
$debug = $string ;
}
$self->_debug("Sending: $debug");
unless ( $self->IsConnected ) {
$self->LastError("NO not connected");
return undef;
}
$self->_send_bytes( \$string );
}
--
Au revoir, 09 51 84 42 42
Gilles Lamiral. France, Baulon (35580) 06 20 79 76 06