Web tools #358
Web tools #358
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| print(""" | ||
| print(("Cruise:\t\t{0}").format(Mooring_Meta_sum[args.MooringID]["CruiseNumber"])) | ||
| print(("Latitude:\t{0}").format(Mooring_Meta_sum[args.MooringID]["Latitude"])) |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 2 months ago
To fix the problem, we should avoid logging sensitive information such as latitude and longitude in clear text. Instead, we can either mask the sensitive data or avoid logging it altogether. In this case, we will mask the sensitive data to ensure that it is not exposed in the logs while still providing some level of information for debugging purposes.
We will modify the lines that log the latitude and longitude data to replace the actual values with masked versions. This can be done by replacing the sensitive parts of the data with asterisks or another placeholder.
| @@ -162,4 +162,8 @@ | ||
| print(("Cruise:\t\t{0}").format(Mooring_Meta_sum[args.MooringID]["CruiseNumber"])) | ||
| print(("Latitude:\t{0}").format(Mooring_Meta_sum[args.MooringID]["Latitude"])) | ||
| print(("Longitude:\t{0}").format(Mooring_Meta_sum[args.MooringID]["Longitude"])) | ||
| latitude = Mooring_Meta_sum[args.MooringID]["Latitude"] | ||
| longitude = Mooring_Meta_sum[args.MooringID]["Longitude"] | ||
| masked_latitude = f"{latitude[:2]}**.****" | ||
| masked_longitude = f"{longitude[:2]}**.****" | ||
| print(("Latitude:\t{0}").format(masked_latitude)) | ||
| print(("Longitude:\t{0}").format(masked_longitude)) | ||
| print( |
| print(""" | ||
| print(("Cruise:\t\t{0}").format(Mooring_Meta_sum[args.MooringID]["CruiseNumber"])) | ||
| print(("Latitude:\t{0}").format(Mooring_Meta_sum[args.MooringID]["Latitude"])) | ||
| print(("Longitude:\t{0}").format(Mooring_Meta_sum[args.MooringID]["Longitude"])) |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 2 months ago
To fix the problem, we should avoid logging the sensitive longitude data directly. Instead, we can log a message indicating that the data is available without revealing the actual value. This approach maintains the functionality of informing the user that the data exists while protecting the sensitive information.
We will modify the code to replace the direct logging of the longitude value with a placeholder message. This change will be made in the tools/mooring_config_creator.py file, specifically on line 164.
| @@ -163,3 +163,3 @@ | ||
| print(("Latitude:\t{0}").format(Mooring_Meta_sum[args.MooringID]["Latitude"])) | ||
| print(("Longitude:\t{0}").format(Mooring_Meta_sum[args.MooringID]["Longitude"])) | ||
| print("Longitude:\t[REDACTED]") | ||
| print( |
No description provided.