binance / binance/binance-futures-connector-python
[Security] WebSocket Connection Logs Expose Proxy Credentials
- Dominant language
- Python
- Stars
- 1.2k
- Forks
- 326
- PR merge metrics
- No merged PRs in 30d
Description
## Bug Name
WebSocket Connection Logs Expose Proxy Credentials
## Attack Scenario
WebSocket manager logs full proxy configuration at DEBUG level in two locations. If users configure authenticated proxies with username/password, proxy credentials appear in plaintext in logs.
## Impact
Proxy credentials in log files exposed to anyone with log access (monitoring systems, log aggregation, shared hosting).
## Components
File: /binance/websocket/binance_socket_manager.py, lines 44-51. Two logging.debug calls with self.proxies. parse_proxies() in utils.py extracts username/password.
## Reproduction
1. Configure WebSocket with authenticated proxy (http://user:pass@proxy:8080).
2. Enable DEBUG logging.
3. Full proxy URL with credentials visible in log output.
## Fix
Sanitize proxy URLs before logging by stripping the userinfo component. Log only the proxy hostname.
## Details
Finding ID: L-01
Severity: Low
---
Researcher: Independent Security Researcher -- Mefai Security Team
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.