Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Add a redaction format to the shared logger

Abierto
  • ¿Algo no está bien?
#944 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Necesita aclaración
Estado de actividad
Tranquilo
Stack tecnológico
node.js, typescript
Área
backend, security

Línea de trabajo

Read common/src/logger.ts, mailer/redact.ts, send.ts:67, and AuditLog.ts:6 to understand the existing formats, redaction rules, and sensitive-field list. The issue leaves pattern selection, key-based redaction, performance and false-positive tradeoffs, and whether this belongs in common unresolved; settle those decisions before implementation. Done means the shared logger’s redaction scope and behavior are defined and validated without replacing the call-site fixes tracked in #943.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

backend question tech debt

common/src/logger.ts is plain winston with errors, timestamp, json and prettyPrint. Nothing redacts, so any call site that puts PII into a log line succeeds silently.

mailer/redact.ts already has rules for exactly this, including a blanket email-address regex, but they only run inside the mailer. send.ts:67 passes SMTP replies through redactString before logging them. Lifting those rules into a winston format would apply the same protection to every log line in the app, including ones not written yet.

This does not replace the call-site fixes

A pattern-based format cannot recognise a JWT, and on a participant profile it would scrub the email while leaving date of birth, home address and phone number. So this is defence in depth for the cases nobody thought about, not the fix for the known ones. Those are tracked in #943.

Open decisions

  • Which patterns. Email addresses are straightforward, free-text names are not.
  • Whether to redact by key name as well as by value shape. password and token are reliable key names, and AuditLog.ts:6 already keeps a SENSITIVE_FIELDS list that could be shared rather than duplicated.
  • The cost of a regex pass on every log call, and the false positive risk on legitimate strings.
  • Whether this belongs in common or stays backend-only.

Related: #936, #943

Lenguaje dominante
TypeScript
Estrellas
4
Forks
0
Merge medio
14 h 50 min
PR fusionados (30 d)
5

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de Garvan-Data-Science-Platform/ctrl

Todos los issues de Garvan-Data-Science-Platform/ctrl

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.