The logging of sensitive information can lead to a data breach and exploitation by potential attackers.
1var { Signale } = require('signale')
2
3function loggingOfSensitiveInformationNoncompliant() {
4 var options = {
5 disabled: false,
6 interactive: false,
7 logLevel: 'info',
8 scope: 'custom',
9 // Noncompliant: empty list is assigned to 'secrets'.
10 secrets: []
11 }
12
13 const logger = new Signale(options)
14 logger.log('Secret is: ', info)
15}
1var { Signale } = require('signale')
2
3function loggingOfSensitiveInformationCompliant() {
4 var options = {
5 disabled: false,
6 interactive: false,
7 logLevel: 'info',
8 scope: 'custom',
9 // Compliant: pattern for 'secrets' is configured and hence will not be logged.
10 secrets: ["[1-9]{10}"]
11 }
12
13 const logger = new Signale(options)
14 logger.log('Secret is: ', info)
15}