Mojira Archive
MCL-9207

JVM crash log contains access token

The bug

When JVM crashes and hs_err_pidXXXXX file is generated, this file contains the access token. Minecraft will redact it in all other places I've seen, but here it's outside of Minecraft's control. But launcher can still edit this file after it's created. I noticed it when someone uploaded his hs_err file to my discord and asked for help, the launcher version I selected is from "-Dminecraft.launcher.brand=minecraft-launcher -Dminecraft.launcher.version=2.0.1003" part of JVM arguments. I didn't test it on any other launcher but it's likely to happen on all of them.

Reproduction steps

  1. Start Minecraft and open a world
  2. Start holding down Ctrl + F3 + C (might not be supported by all keyboards?)
  3. Once Minecraft crashes, look for the hs_err_pidXXXXX.log JVM crash report file in the directory of the Minecraft installation you had launched
  4. Open the crash report with a text editor and search for --accessToken (Note: The crash report shown in the "Minecraft game output" of the launcher is only an extract and does not contain it)
    The JVM crash report contains your access token

Fixed

Bartosz Skrzypczak

2018-04-08, 02:33 PM

2022-06-14, 11:55 PM

2022-03-01, 01:50 AM

1

5

Confirmed

709213

trello

2.0.1003 (Windows), 2.2.8908 (Windows)

2.2.11103 (Windows), 2.2.11104 (Mac), 2.2.11105 (New Windows App), 2.2.11106 (Linux)