Hi,
I am using hibernate with c3p0. I notice the database password is written to the log file without any encryption (through the logging of hibernate properties and c3p0 output to stderr). Is there a way for hibernate to log the properties with password encrypted (or removed)? Is there any option other than turning off the hibernate logging?

Thanks,
--Jiunjiun

Read the rules before posting!
http://www.hibernate.org/ForumMailingli ... AskForHelp

[b]Hibernate version:[/b]
2.1.7

[b]Mapping documents:[/b]

[b]Code between sessionFactory.openSession() and session.close():[/b]

[b]Full stack trace of any exception that occurs:[/b]

[b]Name and version of the database you are using:[/b]
postgres 7.3.x

[b]The generated SQL (show_sql=true):[/b]

[b]Debug level Hibernate log excerpt:[/b]

When server/container is started in DEBUG mode(log4j.properties), Hibernate will print all session properties. You need only restart in mode ERROR and this will only be evident when developers are debugging.

If I'm wrong in that last suggestion, try modifying the source.


- Life is better Open GPL

I don't think I start hibernate in DEBUG mode. Is it the default mode?

I'm not sure about defaults but...

see if you have a file log4j.properties in your classpath.
change any occurance of "=DEBUG" to "=ERROR"

Hi.

Try upgrading to a more recent c3p0 (0.8.5). Recent c3p0's mask username and password when dumping config params.

(Logging as of c3p0-0.8.5 is still to stderr, rather than configurable via logging libs. Under usual circumstances, c3p0 logs very little, although when errors or unexpected conditions occur you'll see them. The next rev will have a means of adapting c3p0's output to configurable logging libraries.)

smiles,
Steve (c3p0 guy)

Dont know that I agree that this is not a production problem. What stops a knowledgable hacker from changing the logging properties file to use the appropriate level to get the password printed out? Granted it obscures it more, but does not secure it.

Obviously its valuable to have this information when debugging, but, IMHO, given the security hole it creates I dont see it as being worth it.

Steve