Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| let _ = channel.eof().await; | ||
| let _ = handle.disconnect(russh::Disconnect::ByApplication, "", "English").await; | ||
|
|
||
| println!("✓ Vault public key injected into {}@{}:{} authorized_keys", username, host, port); |
Check failure
Code scanning / CodeQL
Cleartext logging of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 days ago
In general, to fix cleartext logging of sensitive information, avoid including raw sensitive values (credentials, identifiers tied to infrastructure, etc.) in log or console messages. If context is needed, log only non-sensitive metadata or a redacted/hashed form.
For this specific case, the fix is to change the success message on line 387 so it no longer prints the username value (and, if desired, reduce other connection detail exposure). This preserves behavior (indicating success) without exposing user-specific identifiers. The minimal change is to remove username from the println! format string and its argument list. No new imports or helper methods are required; we only edit the println! call in src/console/commands/cli/ssh_key.rs.
Concretely:
- Locate the
println!on line 387. - Replace the formatted string
"✓ Vault public key injected into {}@{}:{} authorized_keys"with a message that does not interpolateusername, e.g."✓ Vault public key injected into remote authorized_keys", or, if you still want host/port,"✓ Vault public key injected into {}:{} authorized_keys". - Remove
usernamefrom the argument list to match the new format string.
All other logic remains unchanged.
| @@ -384,7 +384,7 @@ | ||
| let _ = channel.eof().await; | ||
| let _ = handle.disconnect(russh::Disconnect::ByApplication, "", "English").await; | ||
|
|
||
| println!("✓ Vault public key injected into {}@{}:{} authorized_keys", username, host, port); | ||
| println!("✓ Vault public key injected into remote authorized_keys on {}:{}", host, port); | ||
| println!(); | ||
| println!("You can now run: stacker deploy"); | ||
|
|
1 participant
No description provided.