Skip to content

Potential fix for code scanning alert no. 3: Clear-text logging of sensitive information #36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Mar 4, 2025
Merged

Potential fix for code scanning alert no. 3: Clear-text logging of sensitive information #36

merged 1 commit into from
Mar 4, 2025

Conversation

@krishnprakash
Copy link
Owner

@krishnprakash krishnprakash commented Mar 4, 2025

Potential fix for https://github.com/krishnprakash/cloudflare-docs/security/code-scanning/3

To fix the problem, we need to ensure that sensitive information such as client_id and client_secret is not logged in clear text. Instead, we can log a message indicating that a service token was created without including the sensitive details. This way, we maintain the functionality of informing the user that the token was created without exposing sensitive information.

  • Modify the log message on line 149 to exclude client_id and client_secret.
  • Ensure that the new log message still provides useful information without exposing sensitive data.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

@krishnprakash @github-advanced-security
Potential fix for code scanning alert no. 3: Clear-text logging of se…
ebcdc0c 
…nsitive information

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@cloudflare-workers-and-pages
Copy link

cloudflare-workers-and-pages bot commented Mar 4, 2025 •
edited
Loading

Deploying cloudflare-docs with  Cloudflare Pages  Cloudflare Pages

Latest commit: ebcdc0c
Status:🚫  Build failed.

View logs

@github-actions
Copy link

github-actions bot commented Mar 4, 2025

Howdy and thanks for contributing to our repo. We review new, external PRs within 2 weeks. If it's been longer than then without any movement, tag the PR Assignees in a comment.

@krishnprakash krishnprakash marked this pull request as ready for review March 4, 2025 01:35
@krishnprakash krishnprakash merged commit d611e5b into production Mar 4, 2025
11 of 12 checks passed
@krishnprakash krishnprakash deleted the alert-autofix-3 branch March 4, 2025 01:35
krishnprakash added a commit that referenced this pull request Mar 6, 2025
@dependabot @krishnprakash @github-advanced-security
[Docs Site] Bump @cloudflare/vitest-pool-workers from 0.7.4 to 0.7.5 (#…
0f14e03 
…39)

* Potential fix for code scanning alert no. 1: Clear-text logging of sensitive information (#35)

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Potential fix for code scanning alert no. 3: Clear-text logging of sensitive information (#36)

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* [Docs Site] Bump @typescript-eslint/parser from 8.25.0 to 8.26.0 (#28)

Dependabot couldn't find the original pull request head commit, a75b142.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [Docs Site] Bump typescript-eslint from 8.25.0 to 8.26.0 (#29)

Dependabot couldn't find the original pull request head commit, 2b80971.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [Docs Site] Bump prettier from 3.5.2 to 3.5.3 (#30)

Dependabot couldn't find the original pull request head commit, 4e69d6c.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [Docs Site] Bump wrangler from 3.109.3 to 3.111.0 (#32)

Dependabot couldn't find the original pull request head commit, 4202e58.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump the npm_and_yarn group across 4 directories with 2 updates (#33)

Bumps the npm_and_yarn group with 2 updates in the /.github/actions/assign-issue directory: [esbuild](https://github.com/evanw/esbuild) and [cross-spawn](https://github.com/moxystudio/node-cross-spawn).
Bumps the npm_and_yarn group with 2 updates in the /.github/actions/assign-pr directory: [esbuild](https://github.com/evanw/esbuild) and [cross-spawn](https://github.com/moxystudio/node-cross-spawn).
Bumps the npm_and_yarn group with 1 update in the /.github/actions/label-products directory: [esbuild](https://github.com/evanw/esbuild).
Bumps the npm_and_yarn group with 1 update in the /.github/actions/label-size directory: [esbuild](https://github.com/evanw/esbuild).


Updates `esbuild` from 0.14.39 to 0.25.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2022.md)
- [Commits](evanw/esbuild@v0.14.39...v0.25.0)

Updates `cross-spawn` from 7.0.3 to 7.0.6
- [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md)
- [Commits](moxystudio/node-cross-spawn@v7.0.3...v7.0.6)

Updates `esbuild` from 0.14.39 to 0.25.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2022.md)
- [Commits](evanw/esbuild@v0.14.39...v0.25.0)

Updates `cross-spawn` from 7.0.3 to 7.0.6
- [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md)
- [Commits](moxystudio/node-cross-spawn@v7.0.3...v7.0.6)

Updates `esbuild` from 0.14.39 to 0.25.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2022.md)
- [Commits](evanw/esbuild@v0.14.39...v0.25.0)

Updates `esbuild` from 0.14.39 to 0.25.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2022.md)
- [Commits](evanw/esbuild@v0.14.39...v0.25.0)

---
updated-dependencies:
- dependency-name: esbuild
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: cross-spawn
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: cross-spawn
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [Docs Site] Bump vitest from 2.1.6 to 2.1.9 in the npm_and_yarn group (#34)

Bumps the npm_and_yarn group with 1 update: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `vitest` from 2.1.6 to 2.1.9
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v2.1.9/packages/vitest)

---
updated-dependencies:
- dependency-name: vitest
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [Docs Site] Bump vitest in the npm_and_yarn group across 1 directory (#37)

Bumps the npm_and_yarn group with 1 update in the / directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `vitest` from 2.1.9 to 3.0.7
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v3.0.7/packages/vitest)

---
updated-dependencies:
- dependency-name: vitest
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump golang.org/x/net (#38)

Bumps the go_modules group with 1 update in the /tools directory: [golang.org/x/net](https://github.com/golang/net).


Updates `golang.org/x/net` from 0.23.0 to 0.33.0
- [Commits](golang/net@v0.23.0...v0.33.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [Docs Site] Bump @cloudflare/vitest-pool-workers from 0.7.4 to 0.7.5

Bumps [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) from 0.7.4 to 0.7.5.
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/[email protected]/packages/vitest-pool-workers)

---
updated-dependencies:
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Phileco <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
krishnprakash added a commit that referenced this pull request Mar 6, 2025
@dependabot @krishnprakash @github-advanced-security
[Docs Site] Bump typescript from 5.7.3 to 5.8.2 (#40)
cc74e98 
* Potential fix for code scanning alert no. 1: Clear-text logging of sensitive information (#35)

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Potential fix for code scanning alert no. 3: Clear-text logging of sensitive information (#36)

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* [Docs Site] Bump @typescript-eslint/parser from 8.25.0 to 8.26.0 (#28)

Dependabot couldn't find the original pull request head commit, a75b142.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [Docs Site] Bump typescript-eslint from 8.25.0 to 8.26.0 (#29)

Dependabot couldn't find the original pull request head commit, 2b80971.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [Docs Site] Bump prettier from 3.5.2 to 3.5.3 (#30)

Dependabot couldn't find the original pull request head commit, 4e69d6c.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [Docs Site] Bump wrangler from 3.109.3 to 3.111.0 (#32)

Dependabot couldn't find the original pull request head commit, 4202e58.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump the npm_and_yarn group across 4 directories with 2 updates (#33)

Bumps the npm_and_yarn group with 2 updates in the /.github/actions/assign-issue directory: [esbuild](https://github.com/evanw/esbuild) and [cross-spawn](https://github.com/moxystudio/node-cross-spawn).
Bumps the npm_and_yarn group with 2 updates in the /.github/actions/assign-pr directory: [esbuild](https://github.com/evanw/esbuild) and [cross-spawn](https://github.com/moxystudio/node-cross-spawn).
Bumps the npm_and_yarn group with 1 update in the /.github/actions/label-products directory: [esbuild](https://github.com/evanw/esbuild).
Bumps the npm_and_yarn group with 1 update in the /.github/actions/label-size directory: [esbuild](https://github.com/evanw/esbuild).


Updates `esbuild` from 0.14.39 to 0.25.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2022.md)
- [Commits](evanw/esbuild@v0.14.39...v0.25.0)

Updates `cross-spawn` from 7.0.3 to 7.0.6
- [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md)
- [Commits](moxystudio/node-cross-spawn@v7.0.3...v7.0.6)

Updates `esbuild` from 0.14.39 to 0.25.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2022.md)
- [Commits](evanw/esbuild@v0.14.39...v0.25.0)

Updates `cross-spawn` from 7.0.3 to 7.0.6
- [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md)
- [Commits](moxystudio/node-cross-spawn@v7.0.3...v7.0.6)

Updates `esbuild` from 0.14.39 to 0.25.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2022.md)
- [Commits](evanw/esbuild@v0.14.39...v0.25.0)

Updates `esbuild` from 0.14.39 to 0.25.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2022.md)
- [Commits](evanw/esbuild@v0.14.39...v0.25.0)

---
updated-dependencies:
- dependency-name: esbuild
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: cross-spawn
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: cross-spawn
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [Docs Site] Bump vitest from 2.1.6 to 2.1.9 in the npm_and_yarn group (#34)

Bumps the npm_and_yarn group with 1 update: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `vitest` from 2.1.6 to 2.1.9
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v2.1.9/packages/vitest)

---
updated-dependencies:
- dependency-name: vitest
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [Docs Site] Bump vitest in the npm_and_yarn group across 1 directory (#37)

Bumps the npm_and_yarn group with 1 update in the / directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `vitest` from 2.1.9 to 3.0.7
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v3.0.7/packages/vitest)

---
updated-dependencies:
- dependency-name: vitest
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump golang.org/x/net (#38)

Bumps the go_modules group with 1 update in the /tools directory: [golang.org/x/net](https://github.com/golang/net).


Updates `golang.org/x/net` from 0.23.0 to 0.33.0
- [Commits](golang/net@v0.23.0...v0.33.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [Docs Site] Bump typescript from 5.7.3 to 5.8.2

Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.7.3 to 5.8.2.
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Changelog](https://github.com/microsoft/TypeScript/blob/main/azure-pipelines.release.yml)
- [Commits](microsoft/TypeScript@v5.7.3...v5.8.2)

---
updated-dependencies:
- dependency-name: typescript
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Phileco <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

size/xs

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@krishnprakash