From 4f1b534aec26e6f33e40f877282465f334c5f1fd Mon Sep 17 00:00:00 2001
From: "Danilo M." <danix@danix.xyz>
Date: Fri, 6 Nov 2026 10:24:23 +0100
Subject: fix(app): keep sensitive details out of debug logs

A log export makes logs easy to share, so audit what they hold. Turn off the sshj trace level, which dumps SSH packets in the clear, password authentication included; until now only the minimum priority of the Android logger kept it out. Drop entry names from commit and autofill match lines, and log only descriptive HTML attributes of form fields, since value and placeholder can hold what the user typed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 app/src/main/java/app/passwordstore/ui/list/StoreActions.kt        | 2 +-
 .../main/java/app/passwordstore/util/autofill/AutofillMatcher.kt   | 2 +-
 .../java/app/passwordstore/util/extensions/AndroidExtensions.kt    | 2 +-
 app/src/main/java/app/passwordstore/util/log/LogcatLogger.kt       | 7 +++----
 4 files changed, 6 insertions(+), 7 deletions(-)

(limited to 'app/src/main/java')

diff --git a/app/src/main/java/app/passwordstore/ui/list/StoreActions.kt b/app/src/main/java/app/passwordstore/ui/list/StoreActions.kt
index 94a234c1..f300a814 100644
--- a/app/src/main/java/app/passwordstore/ui/list/StoreActions.kt
+++ b/app/src/main/java/app/passwordstore/ui/list/StoreActions.kt
@@ -179,7 +179,7 @@ private suspend fun BaseGitActivity.moveFile(source: File, destination: File): B
       }
     }
   if (!moved) {
-    logcat(ERROR) { "Something went wrong while moving $source to $destination." }
+    logcat(ERROR) { "Something went wrong while moving a file." }
     prompts.ask(
       title = getString(R.string.password_move_error_title),
       message = getString(R.string.password_move_error_message, source, destination),
diff --git a/app/src/main/java/app/passwordstore/util/autofill/AutofillMatcher.kt b/app/src/main/java/app/passwordstore/util/autofill/AutofillMatcher.kt
index dbaa5675..b4b3d017 100644
--- a/app/src/main/java/app/passwordstore/util/autofill/AutofillMatcher.kt
+++ b/app/src/main/java/app/passwordstore/util/autofill/AutofillMatcher.kt
@@ -194,7 +194,7 @@ class AutofillMatcher {
               .minus(oldNewPathMap.values)
               .map { match ->
                 val newPath = oldNewPathMap[match] ?: return@map match
-                logcat { "Updating match for $key: $match --> $newPath" }
+                logcat { "Updating match for $key" }
                 newPath
               }
               .toSet()
diff --git a/app/src/main/java/app/passwordstore/util/extensions/AndroidExtensions.kt b/app/src/main/java/app/passwordstore/util/extensions/AndroidExtensions.kt
index 382a5617..e24f96ca 100644
--- a/app/src/main/java/app/passwordstore/util/extensions/AndroidExtensions.kt
+++ b/app/src/main/java/app/passwordstore/util/extensions/AndroidExtensions.kt
@@ -71,7 +71,7 @@ suspend fun FragmentActivity.commitChange(message: String): Result<Unit, Throwab
         )
 
       override suspend fun preExecute(): Boolean {
-        logcat { "Committing with message: '$message'" }
+        logcat { "Committing" }
         return true
       }
     }
diff --git a/app/src/main/java/app/passwordstore/util/log/LogcatLogger.kt b/app/src/main/java/app/passwordstore/util/log/LogcatLogger.kt
index c62e60a8..948e3fa9 100644
--- a/app/src/main/java/app/passwordstore/util/log/LogcatLogger.kt
+++ b/app/src/main/java/app/passwordstore/util/log/LogcatLogger.kt
@@ -12,7 +12,8 @@ import logcat.logcat
 /** An implementation of [AbstractLogger] that forwards logging calls to [logcat]. */
 class LogcatLogger(name: String) : AbstractLogger(name) {
 
-  override fun isTraceEnabled() = true
+  // sshj's trace level dumps every SSH packet in the clear, passwords included. Never log it.
+  override fun isTraceEnabled() = false
 
   override fun isDebugEnabled() = true
 
@@ -27,9 +28,7 @@ class LogcatLogger(name: String) : AbstractLogger(name) {
   @Suppress("RegExpRedundantEscape")
   private fun String.fix() = replace("""(?!<\\)\{\}""".toRegex(), "%s")
 
-  override fun t(message: String, t: Throwable?, vararg args: Any?) {
-    logcat(name, LogPriority.VERBOSE) { message.fix().format(*args) + (t?.asLog() ?: "") }
-  }
+  override fun t(message: String, t: Throwable?, vararg args: Any?) = Unit
 
   override fun d(message: String, t: Throwable?, vararg args: Any?) {
     logcat(name) { message.fix().format(*args) + (t?.asLog() ?: "") }
-- 
cgit v1.2.3