🔒️ Maintenance: Fixes issues detected by code scanning #5207
Conversation
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## master #5207 +/- ##
========================================
- Coverage 87.3% 86.9% -0.4%
========================================
Files 1291 1031 -260
Lines 52918 44433 -8485
Branches 1158 605 -553
========================================
- Hits 46231 38643 -7588
+ Misses 6437 5649 -788
+ Partials 250 141 -109
Flags with carried forward coverage won't be shown. Click here to find out more.
|
pcrespov
added
t:maintenance
|
| @@ -135,8 +137,13 @@ def test_logger_propagation(logger: logging.Logger): | |||
| def _log_arguments( | |||
| logger_obj: logging.Logger, level: int, func: Callable, *args, **kwargs | |||
There was a problem hiding this comment.
at this point it would make sense to drop the *args, but I don't think that is doable. since secrets can still escape via it.
There was a problem hiding this comment.
I see your point. That is indeed what I suggested in the comment.But to remove *args it requires reviewing all the references to this call.
| @@ -61,7 +62,7 @@ async def test_to_curl_command(client: AsyncClient): | |||
|
|
|||
| assert ( | |||
| cmd_short | |||
| == 'curl -X POST -H "host: test_base_http_api" -H "accept: */*" -H "accept-encoding: gzip, deflate" -H "connection: keep-alive" -H "user-agent: python-httpx/0.25.0" -H "x-secret: *****" -H "content-length: 9" -H "content-type: application/json" -d \'{"y": 12}\' https://test_base_http_api/foo?x=3' | |||
| == f'curl -X POST -H "host: test_base_http_api" -H "accept: */*" -H "accept-encoding: gzip, deflate" -H "connection: keep-alive" -H "user-agent: python-httpx/0.25.0" -H "x-secret: {_PLACEHOLDER}" -H "content-length: 9" -H "content-type: application/json" -d \'{{"y": 12}}\' https://test_base_http_api/foo?x=3' | |||
There was a problem hiding this comment.
Q: is this change correct? I would have expected for the secret to be naked like it was before.
There was a problem hiding this comment.
what do you mean by naked? This is as it was before but instead of hard-coding the ***s I am using the placeholder
What do these changes do?
Fixes
Clear-text logging of sensitive informationdetected by code-scanning alerts 27, 28, 29 (in osparc variables), 18 (in log decorators) andmask_sensitive_datato mask values in adict[str, Any]mask_sensitive_datain existing log functionsRelated issue/s
Unnecessary logs:
Mask secrets in logs: