Potential Information Leakage

Open

#3,749 opened on Mar 11, 2024 0 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language: Python
Stars: 37.4k
Forks: 3.3k
PR merge metrics: No merged PRs in 30d

Description

In the source code, sensitive informaiton like api_key is inserted into the log. It is a potential security issue as bescribed in cwe-532. The api_key could be redacted.
The leakage could happen in
1
2
3

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Research direction

Read the cited logging sites in backend/oasst_backend/api/v1/admin.py, inference/server/main.py, and inference/server/oasst_inference_server/worker_utils.py. Trace how api_key values reach those logs and determine the existing project convention for redaction. Done means sensitive API keys are no longer exposed by these logging paths.

Written by the indexing model from the issue text.

Assessment

Tech stack: python
Domain: backend, security
Issue type: Bug
Difficulty: 3/5
Estimated time: 1-2 days
Activity status: Stale
Clarity: Clearly specified
Newbie friendliness: 55/100

A short digest of beginner-friendly GitHub issues.