Hide/mask/scrub secrets/passwords in logs

The problem

Passwords and other secrets sent by sendKeys variants are seen in plaintext in the logs. It would be nice to be able to prevent that somehow.

Details

Suppose I have code that looks like this

var pass = getPassworSecurelySomehow(); //e.g. DPAPI or keychain
myPasswordElement.sendKeys(pass);

The logs will show my password:

[debug] Pushing command to appium work queue: “au.getElement(‘18’).setValueByType('MySecretPass)”

It would be great to be able to write something like myPasswordElement.sendSecureKeys(pass); (without compromising log verbosity), and have those keys scrubbed from the log (e.g. replaced with asterisks).

I realize that this would require client library support too (e.g. in wd) but I figured the support has to start somewhere, and could possibly even exploit some existing mechanism (maybe send a special character value that would mark the text as ‘secret’)?

[dotnetprofessional]

Seems this hasn’t had much traction. We’ve just run into this issue ourselves. As @ohadschn has mentioned these ‘test’ passwords can be more dangerous than the real ones. They are often used to gain access to other systems even if the original password doesn’t provide access. Many organizations have a policy of not logging passwords or committing the to source control (another popular source for hackers).

I like the idea of an optional parameter to the sendKeys method that prevents that data from being logged. I’d go with isSensitive, but redact is fine too.

Is this likely to be added?

[jlipps]

yeah, maybe adding a custom json parameter redact to the sendkeys method would work. We can bring this up with the selenium folks too to see if it’s worth talking about in terms of the spec.

@lukeis @shs96c have you guys had requests before for a flag for sendkeys that will instruct the server not to log the text in case it’s sensitive information?

Alternatively, we could stay within spec and simply have a mode for the Appium server where it doesn’t log any sendkeys information