WIP: 1/26 sprint #171
WIP: 1/26 sprint #171
Conversation
runleveldev
force-pushed
the
sprint
branch
2 times, most recently
from
ef62632 to
bb1367f
Compare
runleveldev
force-pushed
the
sprint
branch
4 times, most recently
from
3e09a13 to
5b3c70e
Compare
runleveldev
force-pushed
the
sprint
branch
4 times, most recently
from
9010bc8 to
6de7ebe
Compare
runleveldev
force-pushed
the
sprint
branch
2 times, most recently
from
130e81b to
169fc50
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| await client.updateLxcConfig(node.name, node.placeholderCtId, { | ||
| [nextMp]: `${proxmoxVolume},mp=${placeholderMountPath}` | ||
| }); | ||
| console.log(`Attached volume to placeholder at ${nextMp} with mount path ${placeholderMountPath}`); |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 15 hours ago
In general, the problem is that sensitive or user-derived information (req.session.user included in placeholderMountPath) is being logged in clear text. To fix this without changing existing functionality, we should avoid logging the sensitive portion while still retaining useful operational information. That means either removing placeholderMountPath from the log message or replacing it with a non-sensitive surrogate (e.g., just the mount point key nextMp or a static description).
The best minimal fix is to adjust the console.log on line 155 in create-a-container/routers/volumes.js so that it does not include placeholderMountPath. We can still log that the attachment succeeded and possibly which Proxmox volume and mount point index were used, which is sufficient for debugging without disclosing user-specific paths. No additional imports or helpers are required; we only change the log string.
Concretely:
- In
create-a-container/routers/volumes.js, locate theconsole.logat line 155. - Replace the message template so it omits
placeholderMountPath, e.g.,console.log(\Attached volume to placeholder at ${nextMp}`);` or a similarly informative but non-sensitive message. - Leave all other code, including construction and use of
placeholderMountPath, unchanged so functionality is preserved.
| @@ -152,7 +152,7 @@ | ||
| [nextMp]: `${proxmoxVolume},mp=${placeholderMountPath}` | ||
| }); | ||
| await client.updateLxcConfig(node.name, node.placeholderCtId, { protection: 1 }); | ||
| console.log(`Attached volume to placeholder at ${nextMp} with mount path ${placeholderMountPath}`); | ||
| console.log(`Attached volume ${proxmoxVolume} to placeholder at mount point ${nextMp}`); | ||
|
|
||
| // Create database record | ||
| await Volume.create({ |
runleveldev
force-pushed
the
sprint
branch
11 times, most recently
from
85300f0 to
10ff000
Compare
No description provided.