github / github/codeql

CleartextLogging.qhelp needs more help

未關閉
#17,574 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

https://github.com/github/codeql/blob/590e93d8edec4d7216935ed4425a7ab77b3b2f34/go/ql/src/Security/CWE-312/CleartextLogging.qhelp#L8-L9

https://github.com/check-spelling-sandbox/argo-cd/security/code-scanning/7

[cmd/argocd-git-ask-pass/commands/argocd_git_ask_pass.go:49](https://github.com/check-spelling-sandbox/argo-cd/blob/4014cc8b040f55dc698295d658cf0eb780ea7203/cmd/argocd-git-ask-pass/commands/argocd_git_ask_pass.go#L49-L49)
```go
case strings.HasPrefix(os.Args[1], "Username"):
fmt.Println(creds.Username)
case strings.HasPrefix(os.Args[1], "Password"):
fmt.Println(creds.Password)
flows to a logging call.
CodeQL
default:
errors.CheckError(fmt.Errorf("unknown credential type '%s'", os.Args[1]))
}
```

It's true, this code is printing a password, that's its *job*. it's a [git `credential.helper`](https://git-scm.com/docs/gitcredentials) program.

This isn't "logging" a password, it's intentionally "printing" the password.

How does one tell CodeQL that this is intended behavior? Is the only real option to wait for https://github.com/github/codeql/issues/11427?

The help should say:

```html


Be aware that the purpose of some programs is to print output.
Do not file tickets complaining about programs doing their jobs, it will not win you any warm fuzzies.


```

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。