Skip to content

SDK is logging sensitive data - transactionKey #460

@safrick

Description

@safrick

The transactionKey value is being logged by authorizenet/authorizenet/lib/net/authorize/util/HttpClient.php : 77.

Using: sdk-php-2.0.3 per composer, although the SDK reports 2.0.2 via vendor/authorizenet/authorizenet/lib/net/authorize/api/constants/ANetEnvironment.php.

Note. vendor/authorizenet/authorizenet/lib/net/authorize/util/AuthorizedNetSensitiveTagsConfig.json does exist and it does contain:
{
"tagName": "transactionKey",
"pattern": "",
"replacement": "",
"disableMask": false
}

Log Message (with mostly all values cleared for this issue report):
[_sendRequest] (vendor/authorizenet/authorizenet/lib/net/authorize/util/HttpClient.php : 77) - Request to AnetApi:
{"ARBUpdateSubscriptionRequest":{"merchantAuthentication":{"name":"","transactionKey":""},"clientId":"sdk-php-2.0.2","refId":"","subscriptionId":"","subscription":{"name":"Monthly Subscription"}}}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions