Proguard left overs

Question

When we run proguard on the following piece of Code it should remove the Logging statment:

Log.d(TAG, "field= "+field+“ : enhancedfield=”+enhancedfield);

But... After compilation you will see this:

Log.d(TAG, new StringBuilder().append("Field= ").append(field)
     .append(“ : enhancedfield=”).append(enhancedfield).toString());

Now when we run proguard on this, you will get some leftovers:

new StringBuilder().append("Field= ").append(field)
    .append(“ : enhancedfield=”).append(enhancedfield).toString();

This leaks info to pottential hackers...

What can i do: Declare a final static boolean and only log when the value is true. Because this value can be determined at compile time, the logging code will not be included when the value is false. But that polutes my code, so i am not that happy with that.

Now my Question: How can i improve this behavior? leaving less leftovers and leaking less information?

score 2 · Answer 1 · answered Dec 10 '12 at 14:44

You could prevent the compiler to use the Stringbuilder by forcing the statements to be separate:

Log.d(TAG, "field:");
Log.d(TAG, field);
Log.d(TAG, "enhancedfield:");
Log.d(TAG, enhancedfield);

This of course has an impact on the result of the logs (4 lines instead of 1) and the code isn't very maintainable.

score 1 · Accepted Answer · edited May 23 '17 at 12:12

1

This is a duplicate of the question Removing unused strings during ProGuard optimisation. You can define your own logging method to avoid the StringBuilder calls.

edited May 23 '17 at 12:12

Community

1
1

answered Dec 11 '12 at 16:33

Eric Lafortune

45,150
8
114
106

AlexWien · Answer 3 · 2012-12-10T13:59:29.847

Log Strings are always a problem in obfuscation, they cannot be obfuscated away, you only could move them in a separate class, which does not help much.

encryption of that strings would be more secure. In our praxis, we dont care much, in very special algorithm, which are the heart of know how, you could remove the logging at all, once you know that these methods work without error.

Using the static final boolean isDebug has the drawback that you cannot enabling logging anymore, you have to rebuild, and install a debug version.

Does the solution with statcic final dbg = false
:

if (dbg) Log.d("unwanted debug log");

really polute your code?

Proguard left overs

3 Answers3