github / github/codeql

CleartextLogging.qhelp needs more help

Offen
#17,574 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
CodeQL
Sterne
10.1k
Forks
2.1k
Ø Merge
2 T. 15 Std.
Gemergte PRs (30 T.)
141

Beschreibung

https://github.com/github/codeql/blob/590e93d8edec4d7216935ed4425a7ab77b3b2f34/go/ql/src/Security/CWE-312/CleartextLogging.qhelp#L8-L9

https://github.com/check-spelling-sandbox/argo-cd/security/code-scanning/7

[cmd/argocd-git-ask-pass/commands/argocd_git_ask_pass.go:49](https://github.com/check-spelling-sandbox/argo-cd/blob/4014cc8b040f55dc698295d658cf0eb780ea7203/cmd/argocd-git-ask-pass/commands/argocd_git_ask_pass.go#L49-L49)
```go
case strings.HasPrefix(os.Args[1], "Username"):
fmt.Println(creds.Username)
case strings.HasPrefix(os.Args[1], "Password"):
fmt.Println(creds.Password)
flows to a logging call.
CodeQL
default:
errors.CheckError(fmt.Errorf("unknown credential type '%s'", os.Args[1]))
}
```

It's true, this code is printing a password, that's its *job*. it's a [git `credential.helper`](https://git-scm.com/docs/gitcredentials) program.

This isn't "logging" a password, it's intentionally "printing" the password.

How does one tell CodeQL that this is intended behavior? Is the only real option to wait for https://github.com/github/codeql/issues/11427?

The help should say:

```html


Be aware that the purpose of some programs is to print output.
Do not file tickets complaining about programs doing their jobs, it will not win you any warm fuzzies.


```

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.