github / github/codeql

Accuracy improvements for py/clear-text-logging-sensitive-data

Abierto
#21,595 1 comentario 0 reacciones 0 asignados Ver en GitHub
question
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

**Description of the issue**
Hey, I found two common cases where the rule doesn't match in my codebase. One creates noise, the other misses a real leak.

First, `SecretStr` masks text automatically (e.g., prints '**********'). Logging these objects is safe, but the rule flags them.

```python
from pydantic import SecretStr

password = SecretStr("super_secret")
logging.info("Login: %s", password) # Flagged, but actually safe
```

2. Logging an exception object leaks its message (via __str__), but the rule misses this if the secret is inside the exception.

```python
secret_token = "secret_123"
# logging.error("Auth failed: %s", secret_token) # Detected ✅
try:
raise ValueError("Auth failed: {}".format(secret_token))
except ValueError as e:
# Currently NOT flagged, but leaks 'secret_123' via __str__ ❌
logging.error("Auth failed: %s", e)
```
Maybe we should add the first pattern to the sanitizers and add the second one as a propagator in the taint tracking config.

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Start with the py/clear-text-logging-sensitive-data query and its taint-tracking configuration, then trace how sanitizers and propagators are defined. Confirm that logging SecretStr is not flagged and that logging an exception containing a secret is flagged, using the issue's examples as regression cases.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
python
Área
security
Tipo de issue
Error
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Tranquilo
Claridad
Bastante claro
Aptitud para principiantes
52/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.