Skip to content

Commit 6dd56a3

Browse files
danluciandanlucian
authored
Merge pull request #5992 from snyk/fix/scrublogger_improvement_e2e
fix: improve the sanitization of local debug logs
2 parents 2399cc1 + 28bde41 commit 6dd56a3

File tree

8 files changed

+118
-25
lines changed

8 files changed

+118
-25
lines changed

‎binary-releases/RELEASE_NOTES.md

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,7 @@
1-
## [1.1297.2](https://github.com/snyk/snyk/compare/v1.1297.1...1.1297.2) (2025-06-16)
1+
## [1.1297.3](https://github.com/snyk/snyk/compare/v1.1297.2...1.1297.3) (2025-06-23)
22

33
The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see [this documentation](https://docs.snyk.io/snyk-cli/releases-and-channels-for-the-snyk-cli)
44

55
### Bug Fixes
66

7-
* **logging:** Improves the sanitization of credentials in local debug logs. ([e054455](https://github.com/snyk/snyk/commit/e054455eab8e686f19c165a8bad86259103a5f5d))
8-
* **language-server:** IDE Connectivity for Proxy Users: Fixes an issue where IDE plugins could fail to connect when operating behind an NTLM proxy.
9-
* **language-server:** Snyk Code Local Engine Fix: Addresses a regression that prevented the Snyk Code Local Engine (SCLE) from functioning correctly within the IDEs.
10-
7+
* **logging:** Improves the sanitization of credentials in local debug logs. ([38322f3](https://github.com/snyk/snyk/commit/38322f377da7e5f1391e1f641710be50989fa4df))

‎cliv2/go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ require (
1616
github.com/snyk/cli-extension-sbom v0.0.0-20250422133603-a5ae6fdf0934
1717
github.com/snyk/container-cli v0.0.0-20250321132345-1e2e01681dd7
1818
github.com/snyk/error-catalog-golang-public v0.0.0-20250429130542-564b0605020e
19-
github.com/snyk/go-application-framework v0.0.0-20250612130357-31093e6eb8ad
19+
github.com/snyk/go-application-framework v0.0.0-20250623124518-ca7ba7d72e68
2020
github.com/snyk/go-httpauth v0.0.0-20240307114523-1f5ea3f55c65
2121
github.com/snyk/snyk-iac-capture v0.6.5
2222
github.com/snyk/snyk-ls v0.0.0-20250613113919-2b232b9d448d

‎cliv2/go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -808,8 +808,8 @@ github.com/snyk/container-cli v0.0.0-20250321132345-1e2e01681dd7 h1:/2+2piwQtB9f
808808
github.com/snyk/container-cli v0.0.0-20250321132345-1e2e01681dd7/go.mod h1:38w+dcAQp9eG3P5t2eNS9eG0reut10AeJjLv5lJ5lpM=
809809
github.com/snyk/error-catalog-golang-public v0.0.0-20250429130542-564b0605020e h1:XFGkHDWA8JTPLr82QzoKVqGytofEYBf68VqoUq8yvXk=
810810
github.com/snyk/error-catalog-golang-public v0.0.0-20250429130542-564b0605020e/go.mod h1:Ytttq7Pw4vOCu9NtRQaOeDU2dhBYUyNBe6kX4+nIIQ4=
811-
github.com/snyk/go-application-framework v0.0.0-20250612130357-31093e6eb8ad h1:RpUp1oayxILiWL6jGnXgAYiz7E44minwFEeDXJU3Xc0=
812-
github.com/snyk/go-application-framework v0.0.0-20250612130357-31093e6eb8ad/go.mod h1:Hy8dugDhTPRPe99Bf4mG7zeh7+OobdWfX5dzhbeQQsU=
811+
github.com/snyk/go-application-framework v0.0.0-20250623124518-ca7ba7d72e68 h1:eTR15PecAEX3F9HvptgPWI1Z936qirRoIGCiK3kALfU=
812+
github.com/snyk/go-application-framework v0.0.0-20250623124518-ca7ba7d72e68/go.mod h1:Hy8dugDhTPRPe99Bf4mG7zeh7+OobdWfX5dzhbeQQsU=
813813
github.com/snyk/go-httpauth v0.0.0-20240307114523-1f5ea3f55c65 h1:CEQuYv0Go6MEyRCD3YjLYM2u3Oxkx8GpCpFBd4rUTUk=
814814
github.com/snyk/go-httpauth v0.0.0-20240307114523-1f5ea3f55c65/go.mod h1:88KbbvGYlmLgee4OcQ19yr0bNpXpOr2kciOthaSzCAg=
815815
github.com/snyk/policy-engine v0.33.2 h1:ZxD6/RQ4vqUAXa64V72SsGjZ8vmnBgZNGYQxMIqctYo=

‎cliv2/internal/cliv2/cliv2.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -427,7 +427,7 @@ func (c *CLI) executeV1Default(proxyInfo *proxy.ProxyInfo, passThroughArgs []str
427427
c.DebugLogger.Println("Launching: ")
428428
c.DebugLogger.Println(" ", c.v1BinaryLocation)
429429
c.DebugLogger.Println(" With Arguments:")
430-
c.DebugLogger.Println(" ", strings.Join(passThroughArgs, ", "))
430+
c.DebugLogger.Println(" ", strings.Join(passThroughArgs, " "))
431431
c.DebugLogger.Println(" With Environment: ")
432432

433433
variablesMap := utils.ToKeyValueMap(snykCmd.Env, "=")

‎cliv2/pkg/basic_workflows/legacycli.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,6 @@ func legacycliWorkflow(
8484
proxyAuthenticationMechanism := httpauth.AuthenticationMechanismFromString(proxyAuthenticationMechanismString)
8585
analyticsDisabled := config.GetBool(configuration.ANALYTICS_DISABLED)
8686

87-
debugLogger.Print("Arguments:", args)
8887
debugLogger.Print("Use StdIO:", useStdIo)
8988
debugLogger.Print("Working directory:", workingDirectory)
9089

‎src/cli/args.ts

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ import {
88
SupportedUserReachableFacingCliArgs,
99
} from '../lib/types';
1010
import { getContainerImageSavePath } from '../lib/container';
11-
import { obfuscateArgs } from '../lib/utils';
1211

1312
export declare interface Global extends NodeJS.Global {
1413
ignoreUnknownCA: boolean;
@@ -119,8 +118,6 @@ export function args(rawArgv: string[]): Args {
119118
debugModule.enable(enable);
120119
}
121120

122-
const debug = debugModule('snyk');
123-
124121
// Late require, see the note re "debug" option above.
125122
const cli = require('./commands');
126123

@@ -273,8 +270,6 @@ export function args(rawArgv: string[]): Args {
273270
global.ignoreUnknownCA = true;
274271
}
275272

276-
debug(command, obfuscateArgs(argv));
277-
278273
return {
279274
command,
280275
method,

‎test/jest/acceptance/debuglog.spec.ts

Lines changed: 111 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ import {
44
createProjectFromWorkspace,
55
} from '../util/createProject';
66

7-
jest.setTimeout(1000 * 60);
7+
jest.setTimeout(10000 * 60);
88

99
describe('debug log', () => {
1010
it('redacts token from env var', async () => {
@@ -48,7 +48,85 @@ describe('debug log', () => {
4848

4949
it('redacts basic authentication', async () => {
5050
const { stderr } = await runSnykCLI(
51-
'container test ubuntu:latest --username=us --password=pw -d',
51+
'container test ubuntu:latest [email protected] --password=solidpassword -d',
52+
{
53+
env: {
54+
...process.env,
55+
SNYK_DISABLE_ANALYTICS: '1',
56+
},
57+
},
58+
);
59+
60+
expect(stderr).not.toContain('Basic am9ob');
61+
expect(stderr).toContain('Basic ***');
62+
63+
expect(stderr).not.toContain('[email protected]');
64+
expect(stderr).not.toContain('solidpassword');
65+
});
66+
67+
it('redacts short-form basic authentication', async () => {
68+
const { stderr } = await runSnykCLI(
69+
'container test ubuntu:latest [email protected] -p=solidpassword -d',
70+
{
71+
env: {
72+
...process.env,
73+
SNYK_DISABLE_ANALYTICS: '1',
74+
},
75+
},
76+
);
77+
78+
expect(stderr).not.toContain('Basic am9ob');
79+
expect(stderr).toContain('Basic ***');
80+
81+
expect(stderr).not.toContain('[email protected]');
82+
expect(stderr).not.toContain('solidpassword');
83+
84+
expect(stderr).toContain('-u=***');
85+
expect(stderr).toContain('-p=***');
86+
});
87+
88+
it('redacts ENV-driven basic authentication', async () => {
89+
const { stderr } = await runSnykCLI('container test ubuntu:latest -d', {
90+
env: {
91+
...process.env,
92+
SNYK_DISABLE_ANALYTICS: '1',
93+
SNYK_REGISTRY_USERNAME: '[email protected]',
94+
SNYK_REGISTRY_PASSWORD: 'solidpassword',
95+
},
96+
});
97+
98+
expect(stderr).not.toContain('Basic am9ob');
99+
expect(stderr).toContain('Basic ***');
100+
101+
expect(stderr).not.toContain('[email protected]');
102+
expect(stderr).not.toContain('solidpassword');
103+
});
104+
105+
it('redacts basic authentication with trace log level', async () => {
106+
const { stderr } = await runSnykCLI(
107+
'container test ubuntu:latest [email protected] --password=solidpassword -d',
108+
{
109+
env: {
110+
...process.env,
111+
SNYK_DISABLE_ANALYTICS: '1',
112+
SNYK_LOG_LEVEL: 'trace',
113+
},
114+
},
115+
);
116+
117+
expect(stderr).not.toContain('Basic am9ob');
118+
expect(stderr).toContain('Basic ***');
119+
120+
expect(stderr).not.toContain('[email protected]');
121+
expect(stderr).not.toContain('solidpassword');
122+
123+
expect(stderr).toContain('"username": "***"');
124+
expect(stderr).toContain('"password": "***"');
125+
});
126+
127+
it('redacts short-form basic authentication with trace log level', async () => {
128+
const { stderr } = await runSnykCLI(
129+
'container test ubuntu:latest [email protected] -p=solidpassword -d',
52130
{
53131
env: {
54132
...process.env,
@@ -58,11 +136,37 @@ describe('debug log', () => {
58136
},
59137
);
60138

61-
// this test only makes sense when Basic auth would be expected, otherwise the checks below
62-
if (stderr.includes('Basic ')) {
63-
expect(stderr).not.toContain('Basic dXM6cHc=');
64-
expect(stderr).toContain('Basic ***');
65-
}
139+
expect(stderr).not.toContain('Basic am9ob');
140+
expect(stderr).toContain('Basic ***');
141+
142+
expect(stderr).not.toContain('[email protected]');
143+
expect(stderr).not.toContain('solidpassword');
144+
145+
expect(stderr).toContain('-u=***');
146+
expect(stderr).toContain('"u": "***"');
147+
expect(stderr).toContain('-p=***');
148+
expect(stderr).toContain('"p": "***"');
149+
});
150+
151+
it('redacts ENV-driven basic authentication with trace log level', async () => {
152+
const { stderr } = await runSnykCLI('container test ubuntu:latest -d', {
153+
env: {
154+
...process.env,
155+
SNYK_DISABLE_ANALYTICS: '1',
156+
SNYK_REGISTRY_USERNAME: '[email protected]',
157+
SNYK_REGISTRY_PASSWORD: 'solidpassword',
158+
SNYK_LOG_LEVEL: 'trace',
159+
},
160+
});
161+
162+
expect(stderr).not.toContain('Basic am9ob');
163+
expect(stderr).toContain('Basic ***');
164+
165+
expect(stderr).not.toContain('[email protected]');
166+
expect(stderr).not.toContain('solidpassword');
167+
168+
expect(stderr).toContain('"REGISTRY_USERNAME": "***"');
169+
expect(stderr).toContain('"REGISTRY_PASSWORD": "***"');
66170
});
67171

68172
it('redacts externally injected bearer token', async () => {

‎ts-binary-wrapper/src/common.ts

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -181,9 +181,7 @@ export function runWrapper(executable: string, cliArguments: string[]): number {
181181
const debug = debugEnabled(cliArguments);
182182

183183
if (debug) {
184-
logErrorWithTimeStamps(
185-
'Executing: ' + executable + ' ' + cliArguments.join(' '),
186-
);
184+
logErrorWithTimeStamps('Executing: ' + executable);
187185
}
188186

189187
const res = spawnSync(executable, cliArguments, {

0 commit comments

Comments
 (0)