Problem
Eight set* handlers call printRequest(datas) which expands to DPRINTF("[REQUEST]\t%s\r\n", ...). By default DPRINTF is a no-op, but when DEBUG = SERIAL_DEBUG is enabled for troubleshooting, four of these handlers leak credentials in plaintext to the serial console:
setNetwork / addNetwork: WiFi passwordsetIoT: MQTT user + password, Cloud token, custom URLsetPush: Telegram bot token, Pushover bot token, Pushover user key, FCM push tokens
Any developer enabling debug logging for diagnostics inadvertently exposes all stored credentials on the serial port.
Root Cause
printRequest() dumps the raw POST body (unparsed JSON) to the serial console via DPRINTF. The four credential handlers were treated identically to non-sensitive handlers like setSystem or setPitmaster.
Fix
Removed printRequest(datas) from setNetwork, addNetwork, setIoT, and setPush. The call remains in non-sensitive handlers (setSystem, setChannels, setPitmaster, setPID, setDCTest, setBluetooth).
Review-Finding: CR-001b-009
Severity: MEDIUM (escalates to HIGH when DEBUG enabled)
Problem
Eight
set*handlers callprintRequest(datas)which expands toDPRINTF("[REQUEST]\t%s\r\n", ...). By defaultDPRINTFis a no-op, but whenDEBUG = SERIAL_DEBUGis enabled for troubleshooting, four of these handlers leak credentials in plaintext to the serial console:setNetwork/addNetwork: WiFi passwordsetIoT: MQTT user + password, Cloud token, custom URLsetPush: Telegram bot token, Pushover bot token, Pushover user key, FCM push tokensAny developer enabling debug logging for diagnostics inadvertently exposes all stored credentials on the serial port.
Root Cause
printRequest()dumps the raw POST body (unparsed JSON) to the serial console viaDPRINTF. The four credential handlers were treated identically to non-sensitive handlers likesetSystemorsetPitmaster.Fix
Removed
printRequest(datas)fromsetNetwork,addNetwork,setIoT, andsetPush. The call remains in non-sensitive handlers (setSystem,setChannels,setPitmaster,setPID,setDCTest,setBluetooth).Review-Finding: CR-001b-009
Severity: MEDIUM (escalates to HIGH when DEBUG enabled)