Debug builds log full plugin methodData (incl. credentials) to logcat

未关闭
  • 哪里不对？
#8,652 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 2 天内回复

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
45/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
android, java, javascript, typescript
领域
mobile, security

调研方向

Start in Bridge.java at callPluginMethod (around lines 832-843), where Logger.verbose prints call.getData(), then check how Logger gates output via CapConfig.loggingBehavior. The JS mirror is createLogFromNative/createLogToNative in native-bridge.js. Done means the redaction approach is agreed with maintainers, and secret-looking keys or oversized payloads no longer print verbatim in either layer.

由索引模型根据 Issue 内容生成。

描述

triage

Problem: in debuggable builds, the native bridge logs every plugin call's full payload. Bridge.java (callPluginMethod, ~832-843) does Logger.verbose("callback: ... methodData: " + call.getData()), enabled by Logger + CapConfig.loggingBehavior (default debug → on when the app is debuggable). The JS bridge (native-bridge.js, createLogFromNative/createLogToNative → c.dir(...)) mirrors it for results. Plugins that carry secrets (e.g. biometric credential storage, secure token storage) end up printing credentials verbatim to logcat.

Repro (any debug build, e.g. a biometric/token plugin):

  • adb logcat shows V Capacitor: callback: <id>, pluginId: <plugin>, methodName: setCredentials, methodData: {"username":"...","password":"<secret material>"}
  • Capacitor/Console shows the result: Msg: {"password":"{...access/refresh tokens...}"}

Impact: debug-only (release unaffected) — but devs run debug builds against real accounts, and logcat is readable via adb and captured in bug reports.

Suggestion: redact/omit methodData (and results) by default, or add a redaction option. loggingBehavior: 'none' disables ALL bridge logs, which removes useful debugging signal — a targeted redaction (e.g. keys like password/token/secret, or truncation) would be better.

Versions: @capacitor/core 8.5.2, @capacitor/android 8.5.2.

主要语言
TypeScript
星标
17k
派生
1.3k
平均合并
3 天 11 小时
30 天内合并 PR
31

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

ionic-team/capacitor 的其他 Issue

查看 ionic-team/capacitor 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。