From 9322bcdb2139b498f7038fce72ce5b025e766fb0 Mon Sep 17 00:00:00 2001 From: Patrickschell609 Date: Sun, 5 Apr 2026 08:54:51 -0400 Subject: [PATCH] fix: redact MQTT password from log output (#10064) MQTT password was logged in cleartext via LOG_INFO when connecting to the broker, exposing credentials to anyone with log access. Replace the password format specifier with a static mask. Co-authored-by: Patrickschell609 Co-authored-by: Claude Opus 4.6 --- src/mqtt/MQTT.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/mqtt/MQTT.cpp b/src/mqtt/MQTT.cpp index ac022a1ab..aba06c210 100644 --- a/src/mqtt/MQTT.cpp +++ b/src/mqtt/MQTT.cpp @@ -322,8 +322,8 @@ bool connectPubSub(const PubSubConfig &config, PubSubClient &pubSub, Client &cli pubSub.setClient(client); pubSub.setServer(config.serverAddr.c_str(), config.serverPort); - LOG_INFO("Connecting directly to MQTT server %s, port: %d, username: %s, password: %s", config.serverAddr.c_str(), - config.serverPort, config.mqttUsername, config.mqttPassword); + LOG_INFO("Connecting directly to MQTT server %s, port: %d, username: %s, password: ***", config.serverAddr.c_str(), + config.serverPort, config.mqttUsername); // Generate node ID from nodenum for client identification std::string nodeId = nodeDB->getNodeId();