Skip to content

Potential fix for code scanning alert no. 7: Clear-text logging of sensitive information#32

Merged
agntperfect merged 1 commit intomainfrom
alert-autofix-7
Sep 29, 2025
Merged

Potential fix for code scanning alert no. 7: Clear-text logging of sensitive information#32
agntperfect merged 1 commit intomainfrom
alert-autofix-7

Conversation

@agntperfect
Copy link
Copy Markdown
Member

Potential fix for https://github.com/FSU-Pulchowk/discord-bot/security/code-scanning/7

To fix the problem, instead of passing environment variables (such as BIRTHDAY_ANNOUNCEMENT_CHANNEL_ID) or any potentially sensitive data directly to log functions, the code should ensure that only non-sensitive information is logged. The best way to prevent leaking sensitive data is to remove or redact such data before logging. Specifically, in src/bot.js, wherever an environment-derived value is logged, its actual value should be masked/redacted or omitted. As for keys where a reference is useful (such as a channel ID), only the existence, shape, or an obfuscated value (e.g., hash or partial) should be logged.

For this case, the log call on line 1680 in src/bot.js is:

this.debugConfig.log('Birthday announcement channel not found', 'scheduler', { channelId: BIRTHDAY_ANNOUNCEMENT_CHANNEL_ID }, null, 'error');

Instead of logging the actual channel ID, log only that the value is present (or missing), or, if really needed, a redacted form (first few/last few characters).

No library changes are needed; change only the argument to log in src/bot.js.
No change is required in src/utils/debug.js (the log method attempts sanitization, but as shown above, code that depends solely on this is not robust enough).

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…nsitive information

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Copy link
Copy Markdown
Member Author

@agntperfect agntperfect left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clear-text logging of sensitive information

@agntperfect agntperfect marked this pull request as ready for review September 29, 2025 23:50
@agntperfect agntperfect merged commit b4d4b0c into main Sep 29, 2025
2 checks passed
@agntperfect agntperfect deleted the alert-autofix-7 branch September 29, 2025 23:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant