github / github/codeql

False positive - A secret detected in a go context causes codeql to think all context values are secret

Đang mở
#16,486 3 bình luận 0 reaction 0 người được giao Xem trên GitHub
acknowledged false-positive Go
Ngôn ngữ chính
CodeQL
Star
10.1k
Fork
2.1k
Merge trung bình
2 ngày 15 giờ
Pull request đã merge (30 ngày)
141

Mô tả

**Description of the false positive**

We use a convenience function to create a logger that includes additional variables taken from a context.Context using the Value call to get the value.

The context itself contains secrets that may be needed. When the logger is created we specify the keys that should be taken from the context to add to the logger.

CodeQL is identifying a *Clear-text logging of sensitive information* which seems to think that taking _any_ value out of the context, regardless of what is requested, is logging sensitive information.

**Code samples or links to source code**

This one is detected in the creation of the logger:

https://github.com/distribution/distribution/blob/56a020f7f1fbec903d785b552c97330c58fddae6/internal/dcontext/logger.go#L138
https://github.com/distribution/distribution/security/code-scanning/36

This one is detected when logging an error using context.Errors, which has been populated with a value from the context that is not secret:
https://github.com/distribution/distribution/blob/56a020f7f1fbec903d785b552c97330c58fddae6/registry/handlers/app.go#L831
https://github.com/distribution/distribution/security/code-scanning/23

There are more in the repo that match the same pattern.

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.