hashmapinc / hashmapinc/Drillflow

Security Violation: Plain Text Authorization Token Found In Drillflow Log

Open
#390 2 comments 0 reactions 1 assignee Claimed by @TessForGithub2 View on GitHub
API bug Deliverable
Dominant language
Java
Stars
21
Forks
13
PR merge metrics
No merged PRs in 30d

Description

SLB reported the following:

"Plain text of credentials found in log file - as per SLB security requirement, credentials (e.g. user password, token, connection string and keys etc.) and personal sensitive information (GDPR classified information) must be removed / sanitized from plain text logging. For example, either totally remove the token from logging or remove the token signature part is OK."

From review of the log attached by SLB, it was found that the following element was present:
"Authorization=Basic V2NsaWVudEBoYXNobWFwaW5jLmNvbTpXaXRzbWwyMDE4LkRyaWxsRmxvdw=="

This reveals a token that must be removed / sanitized.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.