Question

Does anyone know of a log4j or logback class that can redact passwords based on a regular expression?

It looks trivial to write one, but just wanted to check if there was one already out there?

Thanks.

---

Update:

From the comments, it doesn’t sound like such a sensible idea 😉

@Mike:

Good point for new development.

Although for legacy apps, we might not want to modify the code.

And for 3rd party libraries, we might not be able to modify the code.

@Thorbjorn:

A regular expression might be "<password>(.*?)</password>" for example.

Answer 1

Logback offers regexp replacement in layout specs.

See the example at:
http://logback.qos.ch/manual/layouts.html#cwOptions

Something like:

<pattern>%-5level - %replace(%msg){'&lt;password>(.*)&lt;/password>', 'XXXX'}%n</pattern>