Skip to content
This repository has been archived by the owner on Jun 20, 2023. It is now read-only.

Setup Timber and optimize Imports #350

Merged
merged 1 commit into from
Jun 10, 2020
Merged

Setup Timber and optimize Imports #350

merged 1 commit into from
Jun 10, 2020

Conversation

jakobmoellerdev
Copy link
Contributor

No description provided.

Signed-off-by: d067928 <jakob.moeller@sap.com>
@jakobmoellerdev jakobmoellerdev requested a review from a team June 10, 2020 13:48
@jakobmoellerdev jakobmoellerdev added the maintainers Tag pull requests created by maintainers label Jun 10, 2020
@jakobmoellerdev jakobmoellerdev merged commit 7d5e86e into dev Jun 10, 2020
@jakobmoellerdev jakobmoellerdev deleted the feature/timber branch June 10, 2020 14:33
@IndianaDschones
Copy link
Contributor

@jakobmoellersap to securely disable logging in production you need some more changes.

  1. Create a Proguard rule to delete all Timber statements. Just using DebugTree() unfortunately ain´t enough. The statements are still there, but are sent to "nowhere" since no Tree will catch them. It could be that Proguard optimizes them away since this is dead code (?), but my second point remains.
    You can use my Proguard rule, see https://github.com/IndianaDschones/cwa-app-android/blob/7013589fb6e35f3def4f46f36404d276bf089d77/Corona-Warn-App/proguard-rules.pro#L62-L71
  2. With the mentioned Proguard rule, Proguard is able to remove the (surrounding) Timber statements. But everything else "inside" will remain, see Do not log in production #235 (comment).
    Example: code like Timber.d("Storing teletan $teletan") still results in a StringBuilder thus leaking this information in memory (which indeed is another attack vector and not as critical as logging it)
    Solution: you need to use Timber as stated in the Readme (https://github.com/JakeWharton/timber#lint). The above statement should read like Timber.d("Storing teletan %s", teletan). This statement is "simple enough" for Proguard to securely delete since it is the function it should remove (Timber.d) and some simple arguments. %s is for strings, %i for integers and so on (see my branch, where i tried to do it for most statements). Timber can only log simple types.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
maintainers Tag pull requests created by maintainers
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants