fix(logging): avoid logging sensitive param values (#31522)

Summary:
We noticed that by default when the RootView / ReactView calls runApplication, we're logging at an info level any props ("params") passed to that component. In our case, one of these props was sensitive in nature, causing the value to leak out in logs for our release builds. This is especially problematic on Android where device logs can be accessed by any app which requests that permission.

This is probably more of a concern for brownfield react-native apps, but it seems worthwhile locking this down in non-dev builds.

## Changelog

<!-- Help reviewers and the release process by writing your own changelog entry. For an example, see:
https://github.com/facebook/react-native/wiki/Changelog
-->

[General] [Security] - Avoiding logging root view params outside of dev / debug mode builds

Pull Request resolved: https://github.com/facebook/react-native/pull/31522

Test Plan: * build app in release mode on Android and verified I could not see: `Running "my app" with { sensitive: 'thing' }` in logcat in Android Studio with a tethered device

Reviewed By: yungsters

Differential Revision: D31064902

Pulled By: charlesbdudley

fbshipit-source-id: 8b10a46d92a9ec44243dd74384299087260c7d83
This commit is contained in:
Wes Johnson 2021-10-07 12:04:29 -07:00 коммит произвёл Facebook GitHub Bot
Родитель 7bbf549ae5
Коммит e612d3a116
1 изменённых файлов: 4 добавлений и 2 удалений

Просмотреть файл

@ -189,8 +189,10 @@ const AppRegistry = {
displayMode?: number,
): void {
if (appKey !== 'LogBox') {
const msg =
'Running "' + appKey + '" with ' + JSON.stringify(appParameters);
const logParams = __DEV__
? '" with ' + JSON.stringify(appParameters)
: '';
const msg = 'Running "' + appKey + logParams;
infoLog(msg);
BugReporting.addSource(
'AppRegistry.runApplication' + runCount++,