Skip to content

chore: Autofix n.26#198

Merged
AndreaBozzo merged 4 commits intomasterfrom
alert-autofix-26
Jan 29, 2026
Merged

chore: Autofix n.26#198
AndreaBozzo merged 4 commits intomasterfrom
alert-autofix-26

Conversation

@AndreaBozzo
Copy link
Owner

@AndreaBozzo AndreaBozzo commented Jan 29, 2026

Automated hotfix.

In general, to fix cleartext logging of sensitive information, you should avoid including sensitive fields (like passwords, API keys, tokens) in any object that can be implicitly logged with Debug/Display, or ensure they are redacted before logging (e.g., replaced with "***" or omitted). In Rust, a common fix is either to remove Debug for the sensitive type or to provide a manual Debug implementation that redacts sensitive fields, while leaving program behavior otherwise unchanged.

For this code, the minimal change that avoids leaking password in logs without altering functionality is:

  • Remove the #[derive(Debug)] from ConnectionInfo, since it currently includes the password field verbatim.
  • Add a manual impl std::fmt::Debug for ConnectionInfo that prints all non-sensitive fields as before, but redacts the password field (e.g., always printing Some("REDACTED") when a password is present, or None otherwise). The stored password value remains unchanged and is still available to the rest of the program.

Concretely:

  • In src/database/connection.rs, change the #[derive(Debug, Clone)] on ConnectionInfo to #[derive(Clone)].
  • Immediately after the ConnectionInfo definition, add a manual impl std::fmt::Debug for ConnectionInfo that formats the struct, but replaces the actual password with a placeholder. No new external dependencies are required, only std::fmt from the standard library (fully qualified).

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Andrea Bozzo <andreabozzo92@gmail.com>
@AndreaBozzo AndreaBozzo self-assigned this Jan 29, 2026
@AndreaBozzo
Copy link
Owner Author

AndreaBozzo commented Jan 29, 2026

This alert was autotriggered, odds of this happening were ultra low as we don't derive db structures right now.
Still, taking no chances and extending it a bit

@AndreaBozzo AndreaBozzo marked this pull request as ready for review January 29, 2026 14:16
@AndreaBozzo AndreaBozzo changed the title Potential fix for code scanning alert no. 26: Cleartext logging of sensitive information Potential fix for code scanning alert no. 26 Jan 29, 2026
@AndreaBozzo AndreaBozzo changed the title Potential fix for code scanning alert no. 26 Autofix n.26 Jan 29, 2026
@AndreaBozzo AndreaBozzo changed the title Autofix n.26 chore: Autofix n.26 Jan 29, 2026
@AndreaBozzo AndreaBozzo merged commit 18abdfa into master Jan 29, 2026
15 checks passed
@AndreaBozzo AndreaBozzo deleted the alert-autofix-26 branch January 29, 2026 14:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant