github / github/codeql

Accuracy improvements for py/clear-text-logging-sensitive-data

Offen
#21,595 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
question
Vorherrschende Sprache
CodeQL
Sterne
10.1k
Forks
2.1k
Ø Merge
2 T. 15 Std.
Gemergte PRs (30 T.)
141

Beschreibung

**Description of the issue**
Hey, I found two common cases where the rule doesn't match in my codebase. One creates noise, the other misses a real leak.

First, `SecretStr` masks text automatically (e.g., prints '**********'). Logging these objects is safe, but the rule flags them.

```python
from pydantic import SecretStr

password = SecretStr("super_secret")
logging.info("Login: %s", password) # Flagged, but actually safe
```

2. Logging an exception object leaks its message (via __str__), but the rule misses this if the secret is inside the exception.

```python
secret_token = "secret_123"
# logging.error("Auth failed: %s", secret_token) # Detected ✅
try:
raise ValueError("Auth failed: {}".format(secret_token))
except ValueError as e:
# Currently NOT flagged, but leaks 'secret_123' via __str__ ❌
logging.error("Auth failed: %s", e)
```
Maybe we should add the first pattern to the sanitizers and add the second one as a propagator in the taint tracking config.

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Start with the py/clear-text-logging-sensitive-data query and its taint-tracking configuration, then trace how sanitizers and propagators are defined. Confirm that logging SecretStr is not flagged and that logging an exception containing a secret is flagged, using the issue's examples as regression cases.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
python
Bereich
security
Issue-Typ
Bug
Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Aktivitätsstatus
Ruhig
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
52/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.