algolia / algolia/algoliasearch-netlify
Sensitive values in the logs
- Dominant language
- TypeScript
- Stars
- 265
- Forks
- 10
- PR merge metrics
- No merged PRs in 30d
Description
Does the `/api/1/netlify/crawl` response include any secure/sensitive values?
The response might be printed by one of the following statements:
https://github.com/algolia/algoliasearch-netlify/blob/601d32efd6cf18dbbd81e018fecc2c7cd2e427bc/plugin/src/index.ts#L81
https://github.com/algolia/algoliasearch-netlify/blob/601d32efd6cf18dbbd81e018fecc2c7cd2e427bc/plugin/src/index.ts#L91
https://github.com/algolia/algoliasearch-netlify/blob/601d32efd6cf18dbbd81e018fecc2c7cd2e427bc/plugin/src/index.ts#L99
Netlify build logs are sometimes public, in which case there would be a risk for those sensitive values to be made public as well. However, if this endpoint does not respond with any sensitive values, then this is not a concern. I am raising this up just to be 100% sure :)
Contributor guide
Research direction
Start with plugin/src/index.ts at lines 81, 91, and 99, then trace the /api/1/netlify/crawl response those statements may print. Determine whether the response contains secure or sensitive values and verify whether public Netlify build logs could expose them; done means the risk is confirmed or ruled out.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100