Conversation
Signed-off-by: Vinay Singh <vinay@verid.id>
Signed-off-by: Vinay Singh <vinay@verid.id>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| redacted_uri = base_uri + f"{account}:***@{config_url}/{db_name}" | ||
| if params: | ||
| redacted_uri += "?" + urllib.parse.urlencode(params) | ||
| LOGGER.debug("Generated PostgreSQL URI: %s", redacted_uri) |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 months ago
To fix the problem, further redact the URI in log output so that any possibly sensitive credential information (including both the password and the account/username) is removed or obscured. Replace account with a general placeholder (such as ***) or exclude it from the logged URI altogether. Only non-sensitive fields should be emitted to logs. Specifically, in the _build_postgres_dbstore_uri method, change how redacted_uri is constructed so that it replaces account with *** (or another placeholder). Update the log statement (line 260) accordingly. No functional change to the returned (actual) URI construction is needed—only the logged version should be changed. No additional imports or dependencies are needed.
| @@ -254,7 +254,8 @@ | ||
| uri += "?" + urllib.parse.urlencode(params) | ||
|
|
||
| # Log redacted version for security | ||
| redacted_uri = base_uri + f"{account}:***@{config_url}/{db_name}" | ||
| # Redact both account and password | ||
| redacted_uri = base_uri + f"***:***@{config_url}/{db_name}" | ||
| if params: | ||
| redacted_uri += "?" + urllib.parse.urlencode(params) | ||
| LOGGER.debug("Generated PostgreSQL URI: %s", redacted_uri) |
Signed-off-by: Vinay Singh <vinay@verid.id>
Signed-off-by: Vinay Singh <vinay@verid.id>
Signed-off-by: Vinay Singh <vinay@verid.id>
Signed-off-by: Vinay Singh <vinay@verid.id>
Signed-off-by: Vinay Singh <vinay@verid.id>
Signed-off-by: Vinay Singh <vinay@verid.id>
Signed-off-by: Vinay Singh <vinay@verid.id>
1 participant
No description provided.