Mask passwords with JSONPath issue

[mrios]

Hi,

I'm adding to the organization level a mask for passwords. The xml looks like this:

<MaskDataConfiguration name="default">
    <JSONPathsRequest>
        <JSONPathRequest>$..password.</JSONPathRequest>
        <JSONPathRequest>$..oldPassword.</JSONPathRequest>
        <JSONPathRequest>$..newPassword.</JSONPathRequest>
    </JSONPathsRequest>
    <JSONPathsResponse>
        <JSONPathResponse>$..password.</JSONPathResponse>
        <JSONPathResponse>$..oldPassword.</JSONPathResponse>
        <JSONPathResponse>$..newPassword.</JSONPathResponse>
    </JSONPathsResponse>
    <Variables>
        <Variable>ServiceCallout.request</Variable>
        <Variable>request.formparam.password</Variable>
    </Variables>
</MaskDataConfiguration>

Using that description for the mask I noticed that if you have a json request that looks like this

{ "email": "user@abc.com", "password": "password"}

on the Edge I see this

{ "email": "user@abc.com", "**********":"**********"}

which is quite easy to infer the password 🙂

So, is that an expected behavior on the Edge or is it a bug?

Thanks,

Matias