Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Add a redaction format to the shared logger

Aperta
  • Qualcosa non va?
#944 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Da chiarire
Stato di attività
Tranquilla
Stack tecnologico
node.js, typescript
Ambito
backend, security

Direzione di ricerca

Read common/src/logger.ts, mailer/redact.ts, send.ts:67, and AuditLog.ts:6 to understand the existing formats, redaction rules, and sensitive-field list. The issue leaves pattern selection, key-based redaction, performance and false-positive tradeoffs, and whether this belongs in common unresolved; settle those decisions before implementation. Done means the shared logger’s redaction scope and behavior are defined and validated without replacing the call-site fixes tracked in #943.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

backend question tech debt

common/src/logger.ts is plain winston with errors, timestamp, json and prettyPrint. Nothing redacts, so any call site that puts PII into a log line succeeds silently.

mailer/redact.ts already has rules for exactly this, including a blanket email-address regex, but they only run inside the mailer. send.ts:67 passes SMTP replies through redactString before logging them. Lifting those rules into a winston format would apply the same protection to every log line in the app, including ones not written yet.

This does not replace the call-site fixes

A pattern-based format cannot recognise a JWT, and on a participant profile it would scrub the email while leaving date of birth, home address and phone number. So this is defence in depth for the cases nobody thought about, not the fix for the known ones. Those are tracked in #943.

Open decisions

  • Which patterns. Email addresses are straightforward, free-text names are not.
  • Whether to redact by key name as well as by value shape. password and token are reliable key names, and AuditLog.ts:6 already keeps a SENSITIVE_FIELDS list that could be shared rather than duplicated.
  • The cost of a regex pass on every log call, and the false positive risk on legitimate strings.
  • Whether this belongs in common or stays backend-only.

Related: #936, #943

Lingua principale
TypeScript
Stelle
4
Fork
0
Merge medio
14h 50m
PR unite (30g)
5

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Garvan-Data-Science-Platform/ctrl

Tutte le issue di Garvan-Data-Science-Platform/ctrl

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.