Skip to content

fix(security): sanitize clear-text logging in triage, scraper, git_ops - #437

Merged
menil merged 1 commit into
mainfrom
fix/codeql-clear-text-logging
Aug 29, 2026
Merged

fix(security): sanitize clear-text logging in triage, scraper, git_ops#437
menil merged 1 commit into
mainfrom
fix/codeql-clear-text-logging

Conversation

@menil

@menil menil commented Aug 29, 2026

Copy link
Copy Markdown
Owner

Summary

Addresses CodeQL rule py/clear-text-logging-sensitive-data across 3 components:

  • src/jobgitops/cli/triage.py: Omit raw apply_url parameter logging when URL validation fails to avoid logging sensitive query strings or unsafe inputs (JobGitOps-cgp).
  • src/jobgitops/scraper.py: Log character length of issue_body in dry run mode instead of printing raw content snippet (JobGitOps-csc).
  • src/jobgitops/git_ops.py: Apply redact_sensitive_string to original_error in _push_with_lease_retry to prevent accidental token/credential leakage (JobGitOps-dz3).

Verification

  • just validate passed (all 542 unit tests, linter, formatting checks, and 95.25% test coverage).
  • Closed Beads tasks: JobGitOps-cgp, JobGitOps-csc, JobGitOps-dz3.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changes are generally positive: git_ops.py adds redaction of sensitive error messages for better security, and scraper.py reduces exposure of issue bodies in dry-run mode. The triage.py change is a minor clarity improvement. No critical issues found.

Comment thread src/jobgitops/git_ops.py
@menil
menil merged commit c0c2897 into main Aug 29, 2026
7 checks passed
@menil
menil deleted the fix/codeql-clear-text-logging branch August 29, 2026 21:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant