Develop

[phongpham663]

No description provided.

In general, the fix is to ensure that no sensitive data (such as MQTT passwords) is written to logs in clear text. This can be done by either not logging those values at all or by masking/redacting them. In this specific case, we only need to adjust the print statement that logs MQTT subscription details so that it does not risk exposing any part of a tainted configuration tuple. We should keep the existing functionality (subscribing to MQTT) unchanged while reducing logged detail to what is strictly necessary and non-sensitive.

Concretely, in tests/benchmark/run_benchmark.py, around line 528, we should change the print(f"Subscribing to MQTT: {broker}:{port} topic={topic}") to a version that does not include any tainted fields or at least avoids detailed endpoint information derived from the tainted tuple. A simple and safe option is to log only that an MQTT subscription is being set up, optionally including the port (which is generic and not secret) or a static message. This keeps behavior intact while preventing future accidental introduction of {password} or other sensitive values into the log line. No new methods or imports are needed; we are only modifying the string being printed.

In general, to fix clear-text logging of sensitive information, identify any log statements that might include secrets (passwords, API keys, tokens, etc.) and either remove those fields from logs or replace them with redacted placeholders. When working with objects or tuples that mix sensitive and non-sensitive data, avoid logging the whole structure and instead log only explicitly non-sensitive fields.

For this specific case in tests/benchmark/run_benchmark_generic.py, the best fix without changing functionality is:

• Keep reading and using MQTT_PASSWORD to connect, but never log it.
• Make the log statement explicitly log only non-sensitive information, and make it clear that credentials are not logged.
• Optionally annotate in the log that credentials are omitted/redacted to avoid future developers accidentally adding them.

Concretely:

• Keep get_mqtt_config_from_params as-is (lines 201–220), since it only parses configuration and does not log.
• Change the print on line 483 so that it still logs the connection target (broker, port, topic) but makes clear that credentials are not included, and ensure no credentials are interpolated now or in the future.

No new methods are needed; only a small change to the existing print statement is required, within tests/benchmark/run_benchmark_generic.py.