JBoss EAP exposes user password as clear text if log level is set to trace.

When log level is set to TRACE JBoss EAP will out put user password as clear text when the password is specified as annotation on a MDB

For example if a MDB is annotated with following properties:
@ActivationConfigProperty(propertyName = "user", propertyValue = "mdbone"),
@ActivationConfigProperty(propertyName = "password", propertyValue = "mdbone"),

The log will containing the following entry with password.
2011-08-08 12:25:37,238 TRACE [org.hornetq.ra.HornetQResourceAdapter] (main) endpointActivation(org.jboss.ejb3.mdb.inflow.JBossMessageEndpointFactory@34f2d11a

{ resourceAdapter=jms-remote-ra.rar, messagingType=interface javax.jms.MessageListener, ejbName=mdbOne, activationConfig=[ActivationConfigProperty(ConnectionParameters=host=mars;port=5545,host=mars;port=5645), ActivationConfigProperty(minSession=3), ActivationConfigProperty(subscriptionDurability=Durable), ActivationConfigProperty(clientID=mdbone), ActivationConfigProperty(useDLQ=false), ActivationConfigProperty(password=mdbone), ActivationConfigProperty(hA=true), ActivationConfigProperty(destination=/topic/topicOne), ActivationConfigProperty(destinationType=javax.jms.Topic), ActivationConfigProperty(reconnectInterval=20000), ActivationConfigProperty(maxSession=7), ActivationConfigProperty(jndiParams=java.naming.factory.initial=org.jnp.interfaces.NamingContextFactory;java.naming.provider.url=jnp://mars:1199,mars:1299;java.naming.factory.url.pkgs=org.jboss.naming:org.jnp.interfaces), ActivationConfigProperty(reconnectAttempts=2500), ActivationConfigProperty(user=mdbone), ActivationConfigProperty(ConnectorClassName=org.hornetq.core.remoting.impl.netty.NettyConnectorFactory), ActivationConfigProperty(subscriptionName=mdbOne)], activationSpec=org.hornetq.ra.inflow.HornetQActivationSpec(ra=org.hornetq.ra.HornetQResourceAdapter@4964394e destination=/topic/topicOne destinationType=javax.jms.Topic ack=Auto-acknowledge durable=true clientID=mdbone subscription=mdbOne user=mdbone password=**** maxSession=7)}

, org.hornetq.ra.inflow.HornetQActivationSpec(ra=org.hornetq.ra.HornetQResourceAdapter@4964394e destination=/topic/topicOne destinationType=javax.jms.Topic ack=Auto-acknowledge durable=true clientID=mdbone subscription=mdbOne user=mdbone password=**** maxSession=7))

I suspect that this is done in the toString method on JBossMessageEndpointFactory class. This method will output all activation config properties with its values including password.

public String toString()
{
StringBuffer buffer = new StringBuffer(100);
buffer.append(super.toString());
buffer.append("

{ resourceAdapter=").append(resourceAdapterObjectName); buffer.append(", messagingType=").append(messagingTypeClass.getName()); buffer.append(", ejbName=").append(container.getBeanMetaData().getContainerObjectNameJndiName()); buffer.append(", activationConfig=").append(properties.values()); buffer.append(", activationSpec=").append(activationSpec); buffer.append("}

");
return buffer.toString();
}