mirror of
https://github.com/makeplane/plane.git
synced 2026-09-01 19:48:42 +02:00
a6256705e5
The `plane.authentication` logger runs at INFO in production with a JSON formatter that serialises `extra` fields, so anything handed to these log calls is written to the production log stream verbatim. `OauthAdapter.get_user_response()` logged the outgoing request headers on failure, and those headers carry the provider access token as a bearer credential — a live token in clear text. It also had no diagnostic value: the dict has the same shape on every call. Replaced with the provider name and the response status code, which say which IdP failed and how (401 token rejected, 403 scope/rate limit, 404 wrong userinfo URL, None connection error). `Adapter.sanitize_email()` interpolated the rejected address into the log message. It was the only f-string logger call in the package; every sibling logs a constant string and confines the email to the exception payload, which is left untouched, so the caller still receives the address. `GitHubOAuthProvider.set_user_data()` logged the resolved email at DEBUG. That record cannot be emitted today — the console handler is pinned to INFO — but it would start leaking PII the moment a DEBUG handler was attached. The three providers now read their client secret in a call of its own rather than batching it with their non-secret settings. `get_configuration_value()` returns every requested value in one tuple, which makes the secret indistinguishable from the values beside it to anything tracking where it flows; GITEA_HOST and GITLAB_HOST build `userinfo_url`, so the shared tuple marked every response fetched with that URL as secret-derived. Splitting the reads keeps `user_login` — a public GitHub handle and the only per-event signal on the not-in-org line — instead of deleting real audit data to satisfy a false positive. The split is structural only: values resolve by key, in request order, exactly as before. Closes the three open py/clear-text-logging-sensitive-data CodeQL alerts.