codeforboston / codeforboston/CutePetsBoston
Logging may leak slack webhook secret
- Dominant language
- Python
- Stars
- 15
- Forks
- 11
- Avg merge
- 13h 44m
- Merged PRs (30d)
- 2
Description
The current:
except Exception as slack_exc:
logger.error(f"Failed to post Slack alert: {slack_exc}")
may leak slack webhook secret in the case of an unhandled application exception that triggers notify_slack_of_exception() because we currently send slack alert through our app and whether this slack notification is successful or not, urllib3's debug request log (if successful) or the full slack_exc info (if failed) may be in log.
Reproduce this if you plan to fix this.
Contributor guide
No contributing guide indexed for this repository
Research direction
Locate notify_slack_of_exception() and the shown logger.error handler, then reproduce the Slack alert path as the issue requests. Inspect urllib3 debug output and slack_exc logging for both successful and failed notifications; done means the Slack webhook secret is not exposed in application or request logs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100