From cc4031775cc6963fb21e5576f58ee0a3806340a0 Mon Sep 17 00:00:00 2001 From: Romeo Rosete Date: Wed, 21 May 2025 11:52:07 -0400 Subject: [PATCH] Potential fix for code scanning alert no. 11: Clear-text logging of sensitive information Romeo Rosete Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- signer/core/cliui.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/signer/core/cliui.go b/signer/core/cliui.go index fe7695d725..7641052fc8 100644 --- a/signer/core/cliui.go +++ b/signer/core/cliui.go @@ -22,6 +22,7 @@ import ( "encoding/json" "fmt" "os" + "regexp" "strings" "sync" @@ -33,8 +34,9 @@ import ( // sanitizeMessage redacts sensitive information from the input string. func sanitizeMessage(message string) string { - // Example: Replace occurrences of "password: " with "password: [REDACTED]" - return strings.ReplaceAll(message, "password:", "password: [REDACTED]") + // Use regular expressions to redact sensitive information. + re := regexp.MustCompile(`(?i)(password\s*:\s*\S+|private\s*key\s*:\s*\S+|email\s*:\s*\S+@\S+)`) + return re.ReplaceAllString(message, "[REDACTED]") } type CommandlineUI struct {