algolia / algolia/algoliasearch-netlify

Sensitive values in the logs

Open
#39 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
265
Forks
10
PR merge metrics
No merged PRs in 30d

Description

Does the `/api/1/netlify/crawl` response include any secure/sensitive values?

The response might be printed by one of the following statements:

https://github.com/algolia/algoliasearch-netlify/blob/601d32efd6cf18dbbd81e018fecc2c7cd2e427bc/plugin/src/index.ts#L81

https://github.com/algolia/algoliasearch-netlify/blob/601d32efd6cf18dbbd81e018fecc2c7cd2e427bc/plugin/src/index.ts#L91

https://github.com/algolia/algoliasearch-netlify/blob/601d32efd6cf18dbbd81e018fecc2c7cd2e427bc/plugin/src/index.ts#L99

Netlify build logs are sometimes public, in which case there would be a risk for those sensitive values to be made public as well. However, if this endpoint does not respond with any sensitive values, then this is not a concern. I am raising this up just to be 100% sure :)

Contributor guide

Open the contributing guide

Research direction

Start with plugin/src/index.ts at lines 81, 91, and 99, then trace the /api/1/netlify/crawl response those statements may print. Determine whether the response contains secure or sensitive values and verify whether public Netlify build logs could expose them; done means the risk is confirmed or ruled out.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.