False positive in Go / Golang context when logging using %T
- 主要言語
- CodeQL
- スター
- 10.1k
- フォーク
- 2.1k
- 平均マージ
- 2日 15時間
- マージ済み PR(30日)
- 141
説明
**Description of the false positive**
[The warning](https://github.com/developerproductivity/costpuller/security/code-scanning/2) is "Clear-text logging of sensitive information", but what is actually logged is the _type_ of the variable which holds the information and not the information itself.
CodeQL correctly determines that a variable potentially holding a piece of sensitive information is [referenced in a `log.Fatalf()` call](https://github.com/developerproductivity/costpuller/blob/517634a461440261d5f0e5a3ccab0326e32c69a0/cloudability.go#L214-L214), but it misses the fact that the reference is processed using a `%T` format specifier which will result in the log receiving the _type_ of the data and not the _value_ of the data:
```go
apiKeyPair, ok := apiKeyPairAny.([]any)
if !ok {
log.Fatalf("Error reading Cloudability API keypair, expected an array, found %T",
apiKeyPairAny)
```
**Possible workaround**
I'm hoping that the following will suffice to work around the problem, but it's ugly and really shouldn't be necessary!
```go
log.Fatalf("Error reading Cloudability API keypair, expected an array, found %v",
reflect.TypeOf(apiKeyPairAny).String())
```
コントリビューションガイド
調査の方向性
Start by reproducing the CodeQL alert in cloudability.go around line 214 and inspect how the log.Fatalf call and its %T format argument are interpreted. Confirm that logging a value with %T is not treated as clear-text logging of the value, while logging the value itself remains covered; done means the reported false positive is no longer raised.
索引モデルが issue の本文から書いたものです。
評価
- 技術スタック
- go
- 領域
- security
- issue の種類
- バグ
- 難易度
- 4/5
- 見積もり時間
- 3〜5日
- 活発さ
- 停滞
- 明瞭さ
- おおむね明確
- 初心者へのやさしさ
- 35/100