security: _validate_import_line_or_throw logs credential fields at DEBUG level

Open Beginner friendly
#1,829 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
python
Domain
security

Research direction

Start at UserItem.CSVImport._validate_import_line_or_throw and inspect every DEBUG log of the caller-supplied logger, including calls reached through validate_file_for_import. Done means password values from imported CSV lines are masked or omitted from logged representations while validation behavior remains unchanged.

Written by the indexing model from the issue text.

Description

in-progress

Problem

UserItem.CSVImport._validate_import_line_or_throw (and by extension validate_file_for_import) accepts a caller-supplied logger and logs validation details at DEBUG level. The raw CSV values passed in include the password column (column index 1) from user-import files.

If a caller passes a logger with DEBUG enabled — common in development or verbose CI environments — passwords from the import CSV are written to the log output.

Proposed fix

Before any logging in _validate_import_line_or_throw, mask or omit the password field. For example, replace it with "***" in any debug-logged representation of the line:

def _safe_log_line(values):
    masked = list(values)
    if len(masked) > UserItem.CSVImport.ColumnType.PASSWORD:
        masked[UserItem.CSVImport.ColumnType.PASSWORD] = "***"
    return masked

This is a narrow fix — it does not change validation logic, only what gets emitted to the log.

Dominant language
Python
Stars
716
Forks
446
Avg merge
8d 8h
Merged PRs (30d)
2

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from tableau/server-client-python

All issues in tableau/server-client-python

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.