Potential fix for code scanning alert no. 48: Clear-text logging of sensitive information - #161
Potential fix for code scanning alert no. 48: Clear-text logging of sensitive information#161ThePlenkov wants to merge 1 commit into
Conversation
…ensitive information Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
✅ Deploy Preview for adt-cli canceled.
|
|
Warning Review limit reached
Next review available in: 27 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing |
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR successfully addresses the clear-text logging security vulnerability by replacing header value logging with header name-only logging. The implementation correctly eliminates the risk of sensitive data exposure in logs while maintaining debugging utility. The change is minimal, focused, and effective - no blocking issues found.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 0 |
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
|
View your CI Pipeline Execution ↗ for commit bc65cde
💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗ ☁️ Nx Cloud last updated this comment at |
1 participant
Potential fix for https://github.com/abapify/adt-cli/security/code-scanning/48
General fix: never log entire request header objects, even “masked,” because redaction can miss fields now or in future refactors. Prefer logging only minimal, non-sensitive metadata.
Best fix here without changing functionality: in
packages/adt-client/src/adapter.ts, replace the currentsafeHeadersobject logging block near lines 377–386 with an allowlisted summary (e.g., header names only and count). This preserves debugging usefulness while eliminating value exposure risk. No new imports or dependencies are needed.Concretely:
logger?.debug(\HTTP ${options.method} ${url.toString()}`)`.safeHeaders+JSON.stringifyblock with:const headerNames = Object.keys(headers).sort();'Request headers (names only): ' + JSON.stringify(headerNames)Suggested fixes powered by Copilot Autofix. Review carefully before merging.
Summary by cubic
Prevent clear-text logging of sensitive HTTP headers by logging header names only in
packages/adt-client/src/adapter.ts, addressing code scanning alert 48. Keeps the existing debug of method and URL; no behavior changes.Written for commit bc65cde. Summary will update on new commits.