8

I use Kotlin data classes everywhere in my app.

I am using R8 at compile time.

I have a security requirement where the generated toString method cannot contain the original attribute name. At the moment, the generated method, contains the entire classes attributes names in plain text and their obfuscated value names.

public String toString() {
    return "MyClass(id="+this.f1231msd+", password="+this.fj92313+")");
}

I have a few options but I would like to see if there are other options I have not found.

  1. I checked Proguard's source code and found this class that uses the obfuscated name in the toString method. This would be perfect if R8 did this but doesn't seem to.
  2. Manually override each data class' toString method with a blank string.
  3. Write an R8 rule to step 2 for me
  4. Create a compile time annotation to return a blank string for toString

Are there any other options out there?

StuStirling
  • 15,601
  • 23
  • 93
  • 150
  • 5. Get rid of the `toString()` calls, and see if R8 then removes the implementation as being unused. 6. File a feature request to have R8 handle this. 7. Write a Kotlin compiler plugin for the "override `toString()` with blank output" scenario. – CommonsWare Nov 24 '20 at 00:19
  • 5. Good point. I reckon you're right. I use Timber for logging so perhaps R8 isn't stripping the implicit use of these classes `toString()` methods. 6. May just do that 7. Currently looking at implementing a redaction compiler plugin - https://github.com/ZacSweers/redacted-compiler-plugin Thanks for coming back to me – StuStirling Nov 24 '20 at 11:18

1 Answers1

3

After hunting around for other options and solutions, I decided to modify an existing compiler plugin that would automate this for me.

What this does is allows me to still benefit from Kotlin's auto-generated toString() method during development but then redacts the contents of toString() at release compile time.

It outputs a method such as this:

public String toString() {
    return "██";
}

At the moment this is just on my fork in the branch redact-all-and-class-names but potentially it may be included in the main library.

StuStirling
  • 15,601
  • 23
  • 93
  • 150