From 8544b3b82026b4926d2c147be0b7fff072c5f361 Mon Sep 17 00:00:00 2001
From: Boris Grozev <boris@jitsi.org>
Date: Wed, 19 Aug 2026 08:41:19 -0500
Subject: [PATCH 1/2] fix: Redact JWT token in PacketDebugger logging

ConferenceIq carries a JWT auth token. PacketDebugger logs raw stanza
XML at debug level, exposing tokens in log files. Redact them using
the jitsi-xmpp-extensions RedactColibri utility.
---
 .../protocol/xmpp/log/PacketDebugger.java     | 10 ++++-
 .../protocol/xmpp/log/PacketDebuggerTest.kt   | 42 +++++++++++++++++++
 2 files changed, 50 insertions(+), 2 deletions(-)
 create mode 100644 jicofo-common/src/test/kotlin/org/jitsi/impl/protocol/xmpp/log/PacketDebuggerTest.kt

diff --git a/jicofo-common/src/main/java/org/jitsi/impl/protocol/xmpp/log/PacketDebugger.java b/jicofo-common/src/main/java/org/jitsi/impl/protocol/xmpp/log/PacketDebugger.java
index e1f4838f4a..84386f3ba9 100644
--- a/jicofo-common/src/main/java/org/jitsi/impl/protocol/xmpp/log/PacketDebugger.java
+++ b/jicofo-common/src/main/java/org/jitsi/impl/protocol/xmpp/log/PacketDebugger.java
@@ -17,6 +17,7 @@
 
 import edu.umd.cs.findbugs.annotations.*;
 import org.jitsi.utils.logging2.*;
+import org.jitsi.xmpp.util.RedactColibri;
 import org.jivesoftware.smack.*;
 import org.jivesoftware.smack.debugger.*;
 import org.jivesoftware.smack.packet.*;
@@ -66,13 +67,18 @@ public PacketDebugger(XMPPConnection connection, @NonNull String id)
     @Override
     public void onIncomingStreamElement(TopLevelStreamElement streamElement)
     {
-        logger.debug(() -> "RCV PKT (" + id + "): " + streamElement.toXML());
+        logger.debug(() -> "RCV PKT (" + id + "): " + redact(streamElement));
     }
 
     @Override
     public void onOutgoingStreamElement(TopLevelStreamElement streamElement)
     {
-        logger.debug(() -> "SENT PKT (" + id + "): " + streamElement.toXML());
+        logger.debug(() -> "SENT PKT (" + id + "): " + redact(streamElement));
+    }
+
+    private static String redact(TopLevelStreamElement streamElement)
+    {
+        return RedactColibri.Companion.redactToken(streamElement.toXML().toString());
     }
 
     /**
diff --git a/jicofo-common/src/test/kotlin/org/jitsi/impl/protocol/xmpp/log/PacketDebuggerTest.kt b/jicofo-common/src/test/kotlin/org/jitsi/impl/protocol/xmpp/log/PacketDebuggerTest.kt
new file mode 100644
index 0000000000..b53127b8da
--- /dev/null
+++ b/jicofo-common/src/test/kotlin/org/jitsi/impl/protocol/xmpp/log/PacketDebuggerTest.kt
@@ -0,0 +1,42 @@
+/*
+ * Jicofo, the Jitsi Conference Focus.
+ *
+ * Copyright @ 2026 - present 8x8, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.jitsi.impl.protocol.xmpp.log
+
+import io.kotest.core.spec.style.ShouldSpec
+import io.kotest.matchers.string.shouldContain
+import io.kotest.matchers.string.shouldNotContain
+import org.jitsi.xmpp.extensions.jitsimeet.ConferenceIq
+import org.jitsi.xmpp.util.RedactColibri.Companion.redactToken
+import org.jxmpp.jid.impl.JidCreate
+
+class PacketDebuggerTest : ShouldSpec({
+    should("redact the token attribute of a logged ConferenceIq, as done by PacketDebugger") {
+        val token = "eyJhbGciOiJIUzI1NiJ9.super-secret-jwt"
+        val iq = ConferenceIq().apply {
+            room = JidCreate.entityBareFrom("room@conference.example.com")
+            this.token = token
+            stanzaId = "id1"
+        }
+
+        val redacted = redactToken(iq.toXML().toString())
+
+        redacted shouldNotContain token
+        redacted shouldContain "room=\"room@conference.example.com\""
+        redacted shouldContain "token=\"[redacted]\""
+    }
+})

From 44fc3ffc1995cf04129580b40c91f2f0c8fd34c7 Mon Sep 17 00:00:00 2001
From: Boris Grozev <boris@jitsi.org>
Date: Tue, 25 Aug 2026 13:37:11 -0500
Subject: [PATCH 2/2] Bump jitsi-xmpp-extensions to 1.0-120-g80f0eee

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 08f97cc4c0..1dccb2d6e1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -168,7 +168,7 @@
       <dependency>
         <groupId>${project.groupId}</groupId>
         <artifactId>jitsi-xmpp-extensions</artifactId>
-        <version>1.0-119-gc67bc81</version>
+        <version>1.0-120-g80f0eee</version>
       </dependency>
       <dependency>
         <groupId>org.slf4j</groupId>