Issue regarding logging sensitive information

[nevercodecorrect]

trafficstars

Hello, While playing with the tool, I noticed that sensitive information like wordpress password will be logged which could be a potential security issue described in CWE-200. The problematic code is located in here, I am wondering if this is an intended behavior.

[VirtuBox]

Hello @nevercodecorrect, I agree the python classes name are not really good, but in this example, Log.info will display credentials to the user but with log=False to not keep those credentials in /var/log/wo/wordops.log. Let me know if it's still a security issue.

[nevercodecorrect]

Hello @VirtuBox , thanks for the reply. This could still be a security issue although this is not that critical. There is one existing case, it uses logger.info() to print key to stderr. Or there is another example described in CodeQL

[github-actions[bot]]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[github-actions[bot]]

This issue was closed because it has been stalled for 5 days with no activity.