Skip to content

Commit

Permalink
Fix code scanning alert no. 32: Clear-text logging of sensitive infor…
Browse files Browse the repository at this point in the history
…mation

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
  • Loading branch information
1 parent 4cae3a2 commit 25d0cfe
Showing 1 changed file with 8 additions and 2 deletions.
10 changes: 8 additions & 2 deletions src/utils/ssh.ts
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,11 @@ function logDebug(message: string, debug?: boolean) {
if (debug) {
// Sanitize the message to remove sensitive information
const sanitizedMessage = sanitizeSensitiveData(message);
console.log(`[DEBUG] ${sanitizedMessage}`);
if (!sanitizedMessage.includes("password") && !sanitizedMessage.includes("username") && !sanitizedMessage.includes("apn")) {
console.log(`[DEBUG] ${sanitizedMessage}`);

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This logs sensitive data returned by
an access to password
as clear text.
} else {
console.log(`[DEBUG] Sensitive information omitted`);
}
}
}

Expand All @@ -24,7 +28,9 @@ function sanitizeSensitiveData(message: string): string {
return message
.replace(/--password=\S+/g, '--password=****')
.replace(/--username=\S+/g, '--username=****')
.replace(/--apn=\S+/g, '--apn=****');
.replace(/--apn=\S+/g, '--apn=****')
.replace(/--auth-type=\S+/g, '--auth-type=****')
.replace(/--ip-family=\S+/g, '--ip-family=****');
}

/**
Expand Down

0 comments on commit 25d0cfe

Please sign in to comment.