CleartextLogging.qhelp needs more help
- 主要语言
- CodeQL
- 星标
- 10.1k
- 派生
- 2.1k
- 平均合并
- 2 天 15 小时
- 30 天内合并 PR
- 141
描述
https://github.com/github/codeql/blob/590e93d8edec4d7216935ed4425a7ab77b3b2f34/go/ql/src/Security/CWE-312/CleartextLogging.qhelp#L8-L9
https://github.com/check-spelling-sandbox/argo-cd/security/code-scanning/7
[cmd/argocd-git-ask-pass/commands/argocd_git_ask_pass.go:49](https://github.com/check-spelling-sandbox/argo-cd/blob/4014cc8b040f55dc698295d658cf0eb780ea7203/cmd/argocd-git-ask-pass/commands/argocd_git_ask_pass.go#L49-L49)
```go
case strings.HasPrefix(os.Args[1], "Username"):
fmt.Println(creds.Username)
case strings.HasPrefix(os.Args[1], "Password"):
fmt.Println(creds.Password)
flows to a logging call.
CodeQL
default:
errors.CheckError(fmt.Errorf("unknown credential type '%s'", os.Args[1]))
}
```
It's true, this code is printing a password, that's its *job*. it's a [git `credential.helper`](https://git-scm.com/docs/gitcredentials) program.
This isn't "logging" a password, it's intentionally "printing" the password.
How does one tell CodeQL that this is intended behavior? Is the only real option to wait for https://github.com/github/codeql/issues/11427?
The help should say:
```html
Be aware that the purpose of some programs is to print output.
Do not file tickets complaining about programs doing their jobs, it will not win you any warm fuzzies.
```
贡献指南
评估
这个 Issue 还没有评估数据。