lidofinance / lidofinance/validator-ejector
Literal logger secrets are reinterpreted as environment-variable names
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 16
- Forks
- 19
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 7
Description
Locations
Summary
A documented literal LOGGER_SECRETS value is not reliably treated as a literal. If the value is also the name of a populated environment variable, the logger redacts that variable's value and leaves the intended credential exposed.
Root cause
resolveLoggerSecretValues always passes each list entry to envOrFile before deciding whether it is literal. There is no syntax or field separating environment-variable references from literal replacement values, so an existing environment key takes precedence over the documented literal interpretation.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in validator-ejector/src/services/config/service.ts:334-355 and trace resolveLoggerSecretValues through envOrFile. Reproduce the case where a LOGGER_SECRETS entry matches a populated environment variable, then define and verify behavior that preserves the documented literal interpretation without exposing the intended credential.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100