Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| ) | ||
| for secret in secrets_found: | ||
| env_var = secret.upper().replace(".", "_").replace("-", "_") | ||
| logger.warning(f" - {secret} -> Set STREAMTV_{env_var} environment variable") |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 2 months ago
In general, to fix clear-text logging of sensitive information, avoid including any data derived from secrets in log messages. Log only high-level, non-sensitive information (e.g., that a secret is misconfigured) and, if necessary, generic identifiers that are not tainted by secret-handling flows.
For this specific case, the minimal, behavior-preserving fix is to change the per-secret warning so it no longer interpolates the secret value (which CodeQL taints) into the message. Instead, we can log only the derived environment variable name, or even a fully generic message. The core functionality here is to tell users to use environment variables instead of config-file secrets; that can be achieved by logging the recommended environment variable names alone.
Concretely:
- In
Config._warn_secrets_in_config, keep buildingsecrets_foundthe same way. - Keep the initial high-level warning at lines 268–271 as-is.
- Change the loop at lines 272–274 so that:
- We no longer include
secretin the formatted log string. - We only mention the environment variable name to set, e.g.
" - Set STREAMTV_{env_var} environment variable".
- We no longer include
- This removes tainted data from the log sink while preserving the user guidance.
No new methods or imports are required.
| @@ -271,7 +271,7 @@ | ||
| ) | ||
| for secret in secrets_found: | ||
| env_var = secret.upper().replace(".", "_").replace("-", "_") | ||
| logger.warning(f" - {secret} -> Set STREAMTV_{env_var} environment variable") | ||
| logger.warning(f" - Set STREAMTV_{env_var} environment variable") | ||
| logger.warning( | ||
| "See .env.example for a template of all environment variables." | ||
| ) |
1 participant
Description
Brief description of changes
Type of Change
Testing
Checklist
Related Issues
Closes #(issue number)
Screenshots (if applicable)
Add screenshots to help explain your changes.
Additional Notes
Any additional information that reviewers should know.