Repository navigation
fix: do not log raw json value in json validator error - #258
Open
vergiLgood1 wants to merge 1 commit into
Open
vergiLgood1 wants to merge 1 commit into
vergiLgood1 wants to merge 1 commit into
Conversation
The raw value could contain sensitive data (API keys, tokens, service credentials) and would end up in logs via the error output. Follows 1f67e8d, which made the same change for the url validator.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
json()validator includes the entire raw value in its error message:Environment variables parsed as JSON often contain secrets — API tokens, service-account credentials, connection configs. When a JSON env var fails to parse, that raw value currently ends up in the console/log output via the error report.
This changes the error to
"Invalid json", mirroring the change already made for theurlvalidator in 1f67e8d ("Prevent logging of potentially sensitive data in url validator"):Behavior change note: the error message text changes from
Invalid json: "<value>"toInvalid json. No tests asserted the previous message, and debugging value content can still be done locally by inspecting the variable itself.Changes
src/validators.ts— stop including the raw value in the error (same pattern as theurlvalidator)tests/validators.test.ts— regression test: an unparseable JSON value containing a secret produces"Invalid json"with no trace of the raw valueVerification
bun run ts✅bun run lint✅bun run test:ci✅ (67 tests)bun run coverage✅ (functions 100%, lines 98.85%)