binance / binance/binance-connector-python

[Security] Configuration Objects Expose Secrets via Default __dict__ Serialization

Aperta
#513 1 commento 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
Python
Stelle
2.9k
Fork
697
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

## Bug Name
Configuration Objects Expose Secrets via Default __dict__ Serialization

## Attack Scenario
ConfigurationRestAPI, ConfigurationWebSocketAPI, and ConfigurationWebSocketStreams are plain Python classes without __repr__ or __str__ overrides. vars(), __dict__, or any serialization will expose api_secret, private_key, and private_key_passphrase in plaintext.

## Impact
Debug logging, error reporting, or framework introspection that serializes configuration objects will leak credentials.

## Components
File: common/src/binance_common/configuration.py. Affects all three Configuration classes.

## Reproduction
1. Create config = ConfigurationRestAPI(api_key='key', api_secret='secret').
2. Call print(vars(config)).
3. Full api_secret is visible in output.

## Fix
Override __repr__ and __str__ to redact sensitive fields. Consider making secrets properties that return masked values in string representations.

## Details
Finding ID: SEC-06
Severity: Low

---
Researcher: Independent Security Researcher -- Mefai Security Team

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Direzione di ricerca

Start in common/src/binance_common/configuration.py and inspect ConfigurationRestAPI, ConfigurationWebSocketAPI, and ConfigurationWebSocketStreams, then reproduce the vars(config) output described in the issue. Done means sensitive fields such as api_secret, private_key, and private_key_passphrase are not exposed in string representations for all three classes, with coverage for the reported scenario.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
python
Ambito
api, security
Tipo di issue
Bug
Difficoltà
3/5
Tempo stimato
1-2 giorni
Stato di attività
Attiva
Chiarezza
Abbastanza chiara
Idoneità per principianti
68/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.