[QPID-6506] PropertiesFileInitialContextFactory pollutes system properties with values that may contain passwords

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 0.8, 0.32
• Fix Version/s: qpid-java-6.0
• Component/s: JMS AMQP 0-x
• Assignee: Unassigned
• Reporter: Keith Wall
• Created: 23/Apr/15 09:31
• Updated: 02/Oct/19 19:21
• Resolved: 24/Apr/15 13:37

Description

The current implementation of PropertiesFileInitialContextFactory sets each property key encountered in the properties file as a system property (providing a system property with the same name does not already exist).

It is not uncommon for applications or frameworks to log all system properties to aid diagnostics. If such an application were to include the Qpid client, such logging may include connection urls and thus may include passwords in the clear too.

It seems difficult to justify why the PropertiesFileInitialContextFactory should behave in this way. To me, it does not obviously support a end user use-case. The commit comment goes back six years and seems to include a change made to help testing.

Change PropertiesFileInitialContextFactory so that it no longer alters the system properties.