Skip to content

[Security] ServiceConfiguration.cs — Password and ConfirmPassword serialized in plain text during export #466

@Christophe-Rogiers

Description

@Christophe-Rogiers

Severity: Warning

File: src/Servy/Models/ServiceConfiguration.cs, lines 160–163

Description:
Password and ConfirmPassword are plain string properties with no [JsonIgnore] / [XmlIgnore] attributes. When this model is serialized to XML or JSON (used for import/export), both fields are included in the serialized output — meaning exported config files contain the service account password in plain text.

This is a confidentiality risk if users share or back up exported configuration files.

Suggested fix:
Add [JsonIgnore] and [XmlIgnore] attributes to both password fields, or encrypt them during serialization.

Metadata

Metadata

Assignees

Labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions