security: _validate_import_line_or_throw logs credential fields at DEBUG level

[jacalata]

Problem

UserItem.CSVImport._validate_import_line_or_throw (and by extension validate_file_for_import) accepts a caller-supplied logger and logs validation details at DEBUG level. The raw CSV values passed in include the password column (column index 1) from user-import files.

If a caller passes a logger with DEBUG enabled — common in development or verbose CI environments — passwords from the import CSV are written to the log output.

Proposed fix

Before any logging in _validate_import_line_or_throw, mask or omit the password field. For example, replace it with "***" in any debug-logged representation of the line:

def _safe_log_line(values):
    masked = list(values)
    if len(masked) > UserItem.CSVImport.ColumnType.PASSWORD:
        masked[UserItem.CSVImport.ColumnType.PASSWORD] = "***"
    return masked

This is a narrow fix — it does not change validation logic, only what gets emitted to the log.

[Jacek10]

Hi @Jinn-Network team,

I would like to flag a potential security issue (CWE-532: Insertion of Sensitive Information into Log File) within UserItem.CSVImport._validate_import_line_or_throw and validate_file_for_import.

Issue

When a caller provides a logger with DEBUG level enabled, the raw CSV values are logged in their entirety. This unintentionally writes plaintext passwords (located at column index 1) directly into the log output.

Impact

Plaintext credentials can be exposed to anyone with access to local log files, CI pipelines, or centralized logging/monitoring platforms.

Suggested Remedy

We should sanitize or mask index 1 of the raw CSV array before passing it to any logger.debug statement. For example:

safe_values[1] = "[REDACTED_PASSWORD]"
logger.debug("Validating line: " + safe_values)

Please let me know if you would like me to open a Pull Request with this fix, or if your team would prefer to address it internally!