Apache FtpClient prints out password in logs

Question

When it invokes ftp.login(user,pwd) it starts printing password and username which is kind of sensitive to expose to. Is there a way around to not have it printing the password.

Output:

220 <xxxx>- FTP Server ready
USER <prints username here>
331 Password required for <username>
PASS <printspassword here>
230 User <username> logged in

Code:

public FTPDownloadBB(String host, String user, String pwd) throws Exception
{
        FTPClient ftp ftp = new FTPClient();
        ftp.addProtocolCommandListener(new PrintCommandListener(new PrintWriter(System.out)));
        int reply;
        ftp.connect(host);
        reply = ftp.getReplyCode();
        if (!FTPReply.isPositiveCompletion(reply))
        {
            ftp.disconnect();
            throw new Exception("Exception in connecting to FTP Server");
        }
        ftp.login(user, pwd);
        ftp.setFileType(FTP.BINARY_FILE_TYPE);
        ftp.enterLocalPassiveMode();
}

Answer 1

You can suppress the login details while retaining protocol logging by passing an additional boolean into the PrintCommandListener like so:

FTPClient ftp = new FTPClient();
ftp.addProtocolCommandListener(new PrintCommandListener(new PrintWriter(System.out), true));

According to the JavaDoc, this overloaded constructor provides the following utility:

/**
 * Create an instance which optionally suppresses login command text.
 *
 * @param writer where to write the commands and responses
 * @param suppressLogin if {@code true}, only print command name for login
 *
 * @since 3.0
 */

Which we can see here in the resultant logging, where the user and password information are suppressed:

Connected to the target VM, address: '127.0.0.1:61411', transport: 'socket'
220 FTP Server ready.
USER *******
331 Password required for demo_user
PASS *******
230 User demo_user logged in
TYPE I
200 Type set to I
Disconnected from the target VM, address: '127.0.0.1:61411', transport: 'socket'