Skip to content

Commit

Permalink
Fix code scanning alert no. 31: Clear-text logging of sensitive infor…
Browse files Browse the repository at this point in the history
…mation

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
  • Loading branch information
1 parent 5320a0f commit 4cae3a2
Showing 1 changed file with 13 additions and 1 deletion.
14 changes: 13 additions & 1 deletion src/utils/ssh.ts
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,23 @@ import { SSHOptions } from "../types";
function logDebug(message: string, debug?: boolean) {
if (debug) {
// Sanitize the message to remove sensitive information
const sanitizedMessage = message.replace(/--password=\S+/g, '--password=****');
const sanitizedMessage = sanitizeSensitiveData(message);
console.log(`[DEBUG] ${sanitizedMessage}`);

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This logs sensitive data returned by
an access to password
as clear text.
}
}

/**
* Sanitizes a message to remove sensitive information such as passwords, usernames, and other credentials.
* @param {string} message - The message to sanitize.
* @returns {string} The sanitized message.
*/
function sanitizeSensitiveData(message: string): string {
return message
.replace(/--password=\S+/g, '--password=****')
.replace(/--username=\S+/g, '--username=****')
.replace(/--apn=\S+/g, '--apn=****');
}

/**
* Creates an SSH connection using the provided options.
* @param {SSHOptions} options - The SSH connection options.
Expand Down

0 comments on commit 4cae3a2

Please sign in to comment.