Skip to content

v1.19.1 — keep the SportsDB key out of the log by construction

Choose a tag to compare

View all tags
@Jacob-Lasky Jacob-Lasky released this 17 Aug 15:54
· 2 commits to main since this release
v1.19.1
721d794
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch on top of v1.19.0. No behaviour change.

_http_get_json logged redact_secrets(url), and SportsDB carries the API key as a path segment, so the composed URL is key-bearing by construction. The redactor was working, so nothing leaked — but the safety depended on it staying correct, and neither a reader nor a static analyser can confirm that from the call site. CodeQL's py/clear-text-logging-sensitive-data flagged this shape and blocked the 1.19.0 listing in Dispatcharr/Plugins.

It now takes a static endpoint label and logs that, so the key has no path to the log at all. The exception object still goes through the redactor, because urllib's HTTPError stringifies the request URL.

Everything in v1.19.0's notes applies. Tests: 3772 passing.

Assets 3
Loading