binance / binance/binance-connector-python
[Security] Configuration Objects Expose Secrets via Default __dict__ Serialization
- Lingua principale
- Python
- Stelle
- 2.9k
- Fork
- 697
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
## Bug Name
Configuration Objects Expose Secrets via Default __dict__ Serialization
## Attack Scenario
ConfigurationRestAPI, ConfigurationWebSocketAPI, and ConfigurationWebSocketStreams are plain Python classes without __repr__ or __str__ overrides. vars(), __dict__, or any serialization will expose api_secret, private_key, and private_key_passphrase in plaintext.
## Impact
Debug logging, error reporting, or framework introspection that serializes configuration objects will leak credentials.
## Components
File: common/src/binance_common/configuration.py. Affects all three Configuration classes.
## Reproduction
1. Create config = ConfigurationRestAPI(api_key='key', api_secret='secret').
2. Call print(vars(config)).
3. Full api_secret is visible in output.
## Fix
Override __repr__ and __str__ to redact sensitive fields. Consider making secrets properties that return masked values in string representations.
## Details
Finding ID: SEC-06
Severity: Low
---
Researcher: Independent Security Researcher -- Mefai Security Team
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Direzione di ricerca
Start in common/src/binance_common/configuration.py and inspect ConfigurationRestAPI, ConfigurationWebSocketAPI, and ConfigurationWebSocketStreams, then reproduce the vars(config) output described in the issue. Done means sensitive fields such as api_secret, private_key, and private_key_passphrase are not exposed in string representations for all three classes, with coverage for the reported scenario.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- python
- Ambito
- api, security
- Tipo di issue
- Bug
- Difficoltà
- 3/5
- Tempo stimato
- 1-2 giorni
- Stato di attività
- Attiva
- Chiarezza
- Abbastanza chiara
- Idoneità per principianti
- 68/100