Skip to content

Commit e612d3a

Browse files
Wes Johnsonfacebook-github-bot
Wes Johnson
authored andcommitted
fix(logging): avoid logging sensitive param values (#31522)
Summary: We noticed that by default when the RootView / ReactView calls runApplication, we're logging at an info level any props ("params") passed to that component. In our case, one of these props was sensitive in nature, causing the value to leak out in logs for our release builds. This is especially problematic on Android where device logs can be accessed by any app which requests that permission. This is probably more of a concern for brownfield react-native apps, but it seems worthwhile locking this down in non-dev builds. ## Changelog <!-- Help reviewers and the release process by writing your own changelog entry. For an example, see: https://github.com/facebook/react-native/wiki/Changelog --> [General] [Security] - Avoiding logging root view params outside of dev / debug mode builds Pull Request resolved: #31522 Test Plan: * build app in release mode on Android and verified I could not see: `Running "my app" with { sensitive: 'thing' }` in logcat in Android Studio with a tethered device Reviewed By: yungsters Differential Revision: D31064902 Pulled By: charlesbdudley fbshipit-source-id: 8b10a46d92a9ec44243dd74384299087260c7d83
1 parent 7bbf549 commit e612d3a

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

Libraries/ReactNative/AppRegistry.js

+4-2
Original file line numberDiff line numberDiff line change
@@ -189,8 +189,10 @@ const AppRegistry = {
189189
displayMode?: number,
190190
): void {
191191
if (appKey !== 'LogBox') {
192-
const msg =
193-
'Running "' + appKey + '" with ' + JSON.stringify(appParameters);
192+
const logParams = __DEV__
193+
? '" with ' + JSON.stringify(appParameters)
194+
: '';
195+
const msg = 'Running "' + appKey + logParams;
194196
infoLog(msg);
195197
BugReporting.addSource(
196198
'AppRegistry.runApplication' + runCount++,

0 commit comments

Comments
 (0)