Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Participant PII and a session token are written to the logs in plaintext

Abierto
  • ¿Algo no está bien?
#943 3 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
72/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
node.js, typescript
Área
backend, security

Línea de trabajo

Start with the response-logging sites in AuthController.ts, ProfilesController.ts, UsersController.ts, and OrganisationsController.ts; compare their logs with the safer pattern in ParticipantsController.ts. Replace logged response records with operation identifiers such as IDs or counts, keeping the JWT and profile fields out of logs. Done when none of the listed sensitive values are logged; the issue names no test files or commands.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

backend bug

Several controllers log whole response objects with logger.info({ ...responseData }). Where that response contains a user or a profile, the encrypted fields go to stdout in the clear.

email, firstName, middleName and lastName are all /// @encrypted on User in schema.prisma. They are protected in the database and not in the logs. common/src/logger.ts is plain winston with errors, timestamp, json and prettyPrint, so there is no redaction anywhere to catch this.

Sites

Site What reaches the logs
AuthController.ts a valid JWT
ProfilesController.ts firstName, lastName, dob, addressLine, postcode, suburb, state, mobile, email, nextOfKin
UsersController.ts every user's email and name, on every GET /users
UsersController.ts every admin user
UsersController.ts one user's full record
OrganisationsController.ts { data: organisation.users }

UsersController.ts, OrganisationsController.ts, and SurveysController.ts use the same pattern but log ids or non-PII records, so they are fine as they are.

Two that stand out

UsersController.ts is the highest volume. The admin portal calls GET /users to render its list, so it fires during ordinary use rather than only on an error path.

AuthController.ts is a different class from the rest. It is a credential rather than PII, and anyone with log access can use it until it expires.

Suggested fix

Log what identifies the operation, not what it returned. Ids and counts rather than records. The pattern already exists at ParticipantsController.ts:

logger.error({ errorMessage: 'Failed to send participant invite', studyId, inviteId, error })

Context

Found while doing the email-side version of this in #936, which fixed eight sites across ParticipantsController and AuthController in 48fbb00. These are the ones outside that PR's scope.

Same family as #921 and #922.

#944 proposes a redaction format on the shared logger. That is defence in depth rather than the fix for these sites, since a pattern match cannot recognise a JWT and would leave date of birth, address and phone in place on the profile.

Lenguaje dominante
TypeScript
Estrellas
4
Forks
0
Merge medio
14 h 50 min
PR fusionados (30 d)
5

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de Garvan-Data-Science-Platform/ctrl

Todos los issues de Garvan-Data-Science-Platform/ctrl

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.