Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Participant PII and a session token are written to the logs in plaintext

Aperta
  • Qualcosa non va?
#943 3 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
72/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
node.js, typescript
Ambito
backend, security

Direzione di ricerca

Start with the response-logging sites in AuthController.ts, ProfilesController.ts, UsersController.ts, and OrganisationsController.ts; compare their logs with the safer pattern in ParticipantsController.ts. Replace logged response records with operation identifiers such as IDs or counts, keeping the JWT and profile fields out of logs. Done when none of the listed sensitive values are logged; the issue names no test files or commands.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

backend bug

Several controllers log whole response objects with logger.info({ ...responseData }). Where that response contains a user or a profile, the encrypted fields go to stdout in the clear.

email, firstName, middleName and lastName are all /// @encrypted on User in schema.prisma. They are protected in the database and not in the logs. common/src/logger.ts is plain winston with errors, timestamp, json and prettyPrint, so there is no redaction anywhere to catch this.

Sites

Site What reaches the logs
AuthController.ts a valid JWT
ProfilesController.ts firstName, lastName, dob, addressLine, postcode, suburb, state, mobile, email, nextOfKin
UsersController.ts every user's email and name, on every GET /users
UsersController.ts every admin user
UsersController.ts one user's full record
OrganisationsController.ts { data: organisation.users }

UsersController.ts, OrganisationsController.ts, and SurveysController.ts use the same pattern but log ids or non-PII records, so they are fine as they are.

Two that stand out

UsersController.ts is the highest volume. The admin portal calls GET /users to render its list, so it fires during ordinary use rather than only on an error path.

AuthController.ts is a different class from the rest. It is a credential rather than PII, and anyone with log access can use it until it expires.

Suggested fix

Log what identifies the operation, not what it returned. Ids and counts rather than records. The pattern already exists at ParticipantsController.ts:

logger.error({ errorMessage: 'Failed to send participant invite', studyId, inviteId, error })

Context

Found while doing the email-side version of this in #936, which fixed eight sites across ParticipantsController and AuthController in 48fbb00. These are the ones outside that PR's scope.

Same family as #921 and #922.

#944 proposes a redaction format on the shared logger. That is defence in depth rather than the fix for these sites, since a pattern match cannot recognise a JWT and would leave date of birth, address and phone in place on the profile.

Lingua principale
TypeScript
Stelle
4
Fork
0
Merge medio
14h 50m
PR unite (30g)
5

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Garvan-Data-Science-Platform/ctrl

Tutte le issue di Garvan-Data-Science-Platform/ctrl

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.