codeforboston / codeforboston/CutePetsBoston

Logging may leak slack webhook secret

Open
#161 2 comments 0 reactions 0 assignees View on GitHub
good first issue
Dominant language
Python
Stars
15
Forks
11
Avg merge
13h 44m
Merged PRs (30d)
2

Description

The current:
except Exception as slack_exc:
logger.error(f"Failed to post Slack alert: {slack_exc}")

may leak slack webhook secret in the case of an unhandled application exception that triggers notify_slack_of_exception() because we currently send slack alert through our app and whether this slack notification is successful or not, urllib3's debug request log (if successful) or the full slack_exc info (if failed) may be in log.

Reproduce this if you plan to fix this.

Contributor guide

No contributing guide indexed for this repository

Research direction

Locate notify_slack_of_exception() and the shown logger.error handler, then reproduce the Slack alert path as the issue requests. Inspect urllib3 debug output and slack_exc logging for both successful and failed notifications; done means the Slack webhook secret is not exposed in application or request logs.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.