Skip to content

output.xml should honour the current log level and avoid messages which are below log level #5057

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
brrathod opened this issue Feb 19, 2024 · 8 comments

Comments

@brrathod
Copy link

Version: Robot Framework 6.1.1 (Python 3.11.4 on win32)

Currently if the logging level is set to NONE, output.xml file still contains messages which should be logged only if log level is set to INFO or higher. The log.html do not show those messages however output.xml file still contains all log messages. This is a big problem as lot of libraries are writing logs at INFO level where they are output sensitive details like Baic Auth headers and database connections etc. There is currently no way to stop them from appearing in output.xml file. I know that by using --removekeywords and --flattenkeywords command line we can remove them post execution using rebot.exe command however this is still a security concern as after the rebot.exe actual output.xml file is still present where log of sensitive information can be parsed and exploited.

Better approach would be to honor the log level when generating output.xml file and only output messages which are at or above the current log level - if set to NONE no log messages should be present in output.xml

@brrathod
Copy link
Author

This will also helps in reducing the output.xml file size for cases where keywords are using loops. Currently they generate all log messages in output.xml. These type of keywords can be set to log level NONE so that they do not generate large number of log messages while looping through and if required for debug etc. log level can be set accordingly to generate them if required.

@pekkaklarck
Copy link
Member

Do you mean that if you use --loglevel NONE and then have, for example, Log    Message in your test, the logged message is visible? That would be strange because we have tests for this functionality and I also believe someone else would have reported the problem if our tests had detected it.

Alternatively, do you mean that if you have that Log    Message in a test, arguments are shown in the log file regardless the log level? In this case when the message is plain text, it means that the actual message is shown. If the message would be a variable like Log    ${message}, you only see the variable in arguments and the actual value is shown as the logged message (that ought to honor the log level).

@brrathod
Copy link
Author

I think the issue is when I use robot:flatten tag on the keyword it logs at INFO level even if I have set the log level to NONE, I can see log messages in output.xml and also in normal log.html file

@brrathod
Copy link
Author

Here is the sample test.robo which should reproduce the issue

*** Settings ***

*** Variables ***
${user}    dummyuser
${secret}    ThisIsSecret!

*** Keywords ***
Create App Session
    Create Web Session

Create Web Session
    [Documentation]    Does something related to creating a web session
    
    [Tags]    robot:flatten
    ${log}    Set Log Level    NONE
    ${auth}    Create List    ${user}    ${secret}
    Log To Console    Calling a keyword which create web sesson with application     
    Set Log Level    ${log}


*** Test Cases ***
Test Logging     
    Create App Session
    Log To Console    Using session to do some more testing

@pekkaklarck
Copy link
Member

Have you verified this issue occurs also with RF 7.0? See #4921.

@brrathod
Copy link
Author

brrathod commented Mar 8, 2024

I have not tried on RF 7.0 as we using 6.1.1 only currently. Are there any plans to back port fix? What is the LTS version for RF?

@pekkaklarck
Copy link
Member

We don't have resources to backport fixes or to have LTS versions. I hope you can test with RF 7.0 so that we know is the issue resolved or not.

@pekkaklarck
Copy link
Member

I expect this to be a duplicate of #4921.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants