False positive in python/ql/src/Security/CWE-312/CleartextLogging.ql
Offen
false-positive
- Vorherrschende Sprache
- CodeQL
- Sterne
- 10.1k
- Forks
- 2.1k
- Ø Merge
- 2 T. 15 Std.
- Gemergte PRs (30 T.)
- 141
Beschreibung
secrets_client.describe_secret(SecretId=secret_name)
secrets_client.delete_secret(SecretId=secret_name, ForceDeleteWithoutRecovery=True)
print(f"Deleted secret '{secret_name}' in region '{region}'")
This expression logs as clear text.
This expression logs as clear text.
Variable name doesn’t represent a secret.
Beitragsleitfaden
Rechercherichtung
Start with python/ql/src/Security/CWE-312/CleartextLogging.ql and reproduce the issue using the Python snippet in the report. Trace why secret_name is treated as a secret despite the report’s naming evidence; done when this example is no longer flagged while genuine cleartext logging remains detected.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Bewertung
- Tech-Stack
- python
- Bereich
- security
- Issue-Typ
- Bug
- Schwierigkeit
- 3/5
- Geschätzter Aufwand
- 1-2 Tage
- Aktivitätsstatus
- Veraltet
- Klarheit
- Größtenteils klar
- Anfängerfreundlichkeit
- 35/100