Accuracy improvements for py/clear-text-logging-sensitive-data
- Lenguaje dominante
- CodeQL
- Estrellas
- 10.1k
- Forks
- 2.1k
- Merge medio
- 2 d 15 h
- PR fusionados (30 d)
- 141
Descripción
**Description of the issue**
Hey, I found two common cases where the rule doesn't match in my codebase. One creates noise, the other misses a real leak.
First, `SecretStr` masks text automatically (e.g., prints '**********'). Logging these objects is safe, but the rule flags them.
```python
from pydantic import SecretStr
password = SecretStr("super_secret")
logging.info("Login: %s", password) # Flagged, but actually safe
```
2. Logging an exception object leaks its message (via __str__), but the rule misses this if the secret is inside the exception.
```python
secret_token = "secret_123"
# logging.error("Auth failed: %s", secret_token) # Detected ✅
try:
raise ValueError("Auth failed: {}".format(secret_token))
except ValueError as e:
# Currently NOT flagged, but leaks 'secret_123' via __str__ ❌
logging.error("Auth failed: %s", e)
```
Maybe we should add the first pattern to the sanitizers and add the second one as a propagator in the taint tracking config.
Guía de contribución
Línea de trabajo
Start with the py/clear-text-logging-sensitive-data query and its taint-tracking configuration, then trace how sanitizers and propagators are defined. Confirm that logging SecretStr is not flagged and that logging an exception containing a secret is flagged, using the issue's examples as regression cases.
Escrito por el modelo de indexación a partir del texto del issue.
Evaluación
- Stack tecnológico
- python
- Área
- security
- Tipo de issue
- Error
- Dificultad
- 4/5
- Tiempo estimado
- 3-5 días
- Estado de actividad
- Tranquilo
- Claridad
- Bastante claro
- Aptitud para principiantes
- 52/100