2 files changed, 36 insertions, 1 deletions
diff --git a/src/main/java/org/sonarsource/scanner/cli/SystemInfo.java b/src/main/java/org/sonarsource/scanner/cli/SystemInfo.java
index 5dfd6bd..84696fb 100644
--- a/src/main/java/org/sonarsource/scanner/cli/SystemInfo.java
+++ b/src/main/java/org/sonarsource/scanner/cli/SystemInfo.java
@@ -19,7 +19,16 @@
  */
 package org.sonarsource.scanner.cli;
 
+import java.util.Set;
+import java.util.regex.Pattern;
+import java.util.stream.Collectors;
+
 class SystemInfo {
+  private static final Set<String> SENSITIVE_JVM_ARGUMENTS = Set.of(
+      "-Dsonar.login",
+      "-Dsonar.password",
+      "-Dsonar.token");
+  private static final Pattern PATTERN_ARGUMENT_SEPARATOR = Pattern.compile("\\s+");
   private static System2 system = new System2();
 
   private SystemInfo() {
@@ -35,8 +44,22 @@ class SystemInfo {
     logger.info(os());
     String scannerOpts = system.getenv("SONAR_SCANNER_OPTS");
     if (scannerOpts != null) {
-      logger.info("SONAR_SCANNER_OPTS=" + scannerOpts);
+      logger.info("SONAR_SCANNER_OPTS=" + redactSensitiveArguments(scannerOpts));
+    }
+  }
+
+  private static String redactSensitiveArguments(String scannerOpts) {
+    return PATTERN_ARGUMENT_SEPARATOR.splitAsStream(scannerOpts)
+      .map(SystemInfo::redactArgumentIfSensistive)
+      .collect(Collectors.joining(" "));
+  }
+
+  private static String redactArgumentIfSensistive(String argument) {
+    String[] elems = argument.split("=");
+    if (elems.length > 0 && SENSITIVE_JVM_ARGUMENTS.contains(elems[0])) {
+      return elems[0] + "=*";
     }
+    return argument;
   }
 
   static String java() {
diff --git a/src/test/java/org/sonarsource/scanner/cli/SystemInfoTest.java b/src/test/java/org/sonarsource/scanner/cli/SystemInfoTest.java
index c6c0585..3e11c44 100644
--- a/src/test/java/org/sonarsource/scanner/cli/SystemInfoTest.java
+++ b/src/test/java/org/sonarsource/scanner/cli/SystemInfoTest.java
@@ -89,4 +89,16 @@ public class SystemInfoTest {
     verify(logs).info("SONAR_SCANNER_OPTS=arg");
     verifyNoMoreInteractions(logs);
   }
+
+  @Test
+  public void should_not_print_sensitive_data() {
+    mockOs();
+    mockJava();
+    when(mockSystem.getenv("SONAR_SCANNER_OPTS"))
+      .thenReturn("-Dsonar.login=login -Dsonar.whatever=whatever -Dsonar.password=password -Dsonar.whatever2=whatever2 -Dsonar.token=token");
+
+    SystemInfo.print(logs);
+
+    verify(logs).info("SONAR_SCANNER_OPTS=-Dsonar.login=* -Dsonar.whatever=whatever -Dsonar.password=* -Dsonar.whatever2=whatever2 -Dsonar.token=*");
+  }
 }