Accuracy improvements for py/clear-text-logging-sensitive-data
- Vorherrschende Sprache
- CodeQL
- Sterne
- 10.1k
- Forks
- 2.1k
- Ø Merge
- 2 T. 15 Std.
- Gemergte PRs (30 T.)
- 141
Beschreibung
**Description of the issue**
Hey, I found two common cases where the rule doesn't match in my codebase. One creates noise, the other misses a real leak.
First, `SecretStr` masks text automatically (e.g., prints '**********'). Logging these objects is safe, but the rule flags them.
```python
from pydantic import SecretStr
password = SecretStr("super_secret")
logging.info("Login: %s", password) # Flagged, but actually safe
```
2. Logging an exception object leaks its message (via __str__), but the rule misses this if the secret is inside the exception.
```python
secret_token = "secret_123"
# logging.error("Auth failed: %s", secret_token) # Detected ✅
try:
raise ValueError("Auth failed: {}".format(secret_token))
except ValueError as e:
# Currently NOT flagged, but leaks 'secret_123' via __str__ ❌
logging.error("Auth failed: %s", e)
```
Maybe we should add the first pattern to the sanitizers and add the second one as a propagator in the taint tracking config.
Beitragsleitfaden
Rechercherichtung
Start with the py/clear-text-logging-sensitive-data query and its taint-tracking configuration, then trace how sanitizers and propagators are defined. Confirm that logging SecretStr is not flagged and that logging an exception containing a secret is flagged, using the issue's examples as regression cases.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Bewertung
- Tech-Stack
- python
- Bereich
- security
- Issue-Typ
- Bug
- Schwierigkeit
- 4/5
- Geschätzter Aufwand
- 3-5 Tage
- Aktivitätsstatus
- Ruhig
- Klarheit
- Größtenteils klar
- Anfängerfreundlichkeit
- 52/100