Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Participant PII and a session token are written to the logs in plaintext

未关闭
  • 哪里不对？
#943 3 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
72/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
node.js, typescript
领域
backend, security

调研方向

Start with the response-logging sites in AuthController.ts, ProfilesController.ts, UsersController.ts, and OrganisationsController.ts; compare their logs with the safer pattern in ParticipantsController.ts. Replace logged response records with operation identifiers such as IDs or counts, keeping the JWT and profile fields out of logs. Done when none of the listed sensitive values are logged; the issue names no test files or commands.

由索引模型根据 Issue 内容生成。

描述

backend bug

Several controllers log whole response objects with logger.info({ ...responseData }). Where that response contains a user or a profile, the encrypted fields go to stdout in the clear.

email, firstName, middleName and lastName are all /// @encrypted on User in schema.prisma. They are protected in the database and not in the logs. common/src/logger.ts is plain winston with errors, timestamp, json and prettyPrint, so there is no redaction anywhere to catch this.

Sites

Site What reaches the logs
AuthController.ts a valid JWT
ProfilesController.ts firstName, lastName, dob, addressLine, postcode, suburb, state, mobile, email, nextOfKin
UsersController.ts every user's email and name, on every GET /users
UsersController.ts every admin user
UsersController.ts one user's full record
OrganisationsController.ts { data: organisation.users }

UsersController.ts, OrganisationsController.ts, and SurveysController.ts use the same pattern but log ids or non-PII records, so they are fine as they are.

Two that stand out

UsersController.ts is the highest volume. The admin portal calls GET /users to render its list, so it fires during ordinary use rather than only on an error path.

AuthController.ts is a different class from the rest. It is a credential rather than PII, and anyone with log access can use it until it expires.

Suggested fix

Log what identifies the operation, not what it returned. Ids and counts rather than records. The pattern already exists at ParticipantsController.ts:

logger.error({ errorMessage: 'Failed to send participant invite', studyId, inviteId, error })

Context

Found while doing the email-side version of this in #936, which fixed eight sites across ParticipantsController and AuthController in 48fbb00. These are the ones outside that PR's scope.

Same family as #921 and #922.

#944 proposes a redaction format on the shared logger. That is defence in depth rather than the fix for these sites, since a pattern match cannot recognise a JWT and would leave date of birth, address and phone in place on the profile.

主要语言
TypeScript
星标
4
派生
0
平均合并
14 小时 50 分钟
30 天内合并 PR
5

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

Garvan-Data-Science-Platform/ctrl 的其他 Issue

查看 Garvan-Data-Science-Platform/ctrl 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。